An organization has three custom prioritization rules: Rule A applies to all alerts from 'Source1' and assigns 'medium'. Rule B applies to alerts from 'Source1' with severity 'high' and assigns 'high'. Rule C applies to alerts from 'Source1' with severity 'high' and the custom field 'environment: production' and assigns 'critical'. An alert arrives from 'Source1' with severity 'high' and the field 'environment: production'. Which rule will be applied?

All three rules, and the highest priority is applied.

Rule C, because it has the most specific conditions.

Rule A, because it applies to all alerts from the source, and broader rules are evaluated first.

Rule B, because it matches the severity and source, and was created before Rule C.

What priority levels can be assigned to alerts using a custom prioritization rule?

Informational, warning, and critical only

When configuring a custom prioritization rule, what does the 'priority level' setting determine?

The order in which the rule is evaluated

The data source that the rule applies to

The severity of the alert as displayed in the UI

The importance assigned to alerts that match the rule

What does the 'alert sources' selection in a custom prioritization rule control?

The conditions that must be met for the rule to apply

The priority level that will be assigned

Which data sources the rule will apply to

The order in which the rule is evaluated

Palo Alto NetworksCertified XSIAM Analyst

Domain 1Objective 3

1.3 Configure Custom Prioritizations XSIAM-ANALYST Practice Questions (Page 2)

Part of the Alerting and Detection Processes domain, which accounts for 19% of the XSIAM-ANALYST exam.

26questions here

6free pages

9concepts

19%of the exam

Questions 6–10

6foundation · easy
Which of the following can be used as a condition in a custom prioritization rule?
Select an answer first
7expert · hard
An organization has three custom prioritization rules: Rule A applies to all alerts from 'Source1' and assigns 'medium'. Rule B applies to alerts from 'Source1' with severity 'high' and assigns 'high'. Rule C applies to alerts from 'Source1' with severity 'high' and the custom field 'environment: production' and assigns 'critical'. An alert arrives from 'Source1' with severity 'high' and the field 'environment: production'. Which rule will be applied?
Select an answer first
8foundation · easy
What priority levels can be assigned to alerts using a custom prioritization rule?
Select an answer first
9foundation · easy
When configuring a custom prioritization rule, what does the 'priority level' setting determine?
Select an answer first
10foundation · easy
What does the 'alert sources' selection in a custom prioritization rule control?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XSIAM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSIAM-ANALYST” is a trademark of its owner, used for identification only.

1.3 Configure Custom Prioritizations XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

Which of the following can be used as a condition in a custom prioritization rule?

What priority levels can be assigned to alerts using a custom prioritization rule?

When configuring a custom prioritization rule, what does the 'priority level' setting determine?

What does the 'alert sources' selection in a custom prioritization rule control?

Keep studying — Alerting and Detection Processes