2.1 Explain the Incident Creation Process XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An alert fires for a potential data exfiltration from a finance server that contains sensitive customer data. The alert indicates that a large volume of data has been transferred. According to XSIAM's severity assignment logic, what should the incident severity be?

   • ALow, because the alert is just a potential exfiltration.
   • BMedium, because the alert is automated.
   • CHigh, but not critical, because no data loss is confirmed.
   • DCritical, because the affected asset is sensitive and the potential impact is high.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An alert is generated by the XDR detection engine for a suspicious process. According to the XSIAM incident creation workflow, what happens after the alert is evaluated by correlation and grouping rules?

   • AThe alert is either added to an existing incident or used to create a new incident.
   • BThe alert is sent to the ticketing system before incident creation.
   • CThe alert is manually reviewed by an analyst before any incident is created.
   • DThe alert is automatically closed as a false positive.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In the incident lifecycle, which stage involves determining the priority of the incident and assigning it to the appropriate team?

   • ATriage
   • BCreation
   • CContainment
   • DInvestigation
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC notices that a single incident contains alerts from two different attack campaigns targeting different departments. The analysts want to handle them separately. What should the SOC do in XSIAM?

   • ASplit the incident into two separate incidents based on the campaign correlation.
   • BClose the incident and create two new incidents manually.
   • CChange the grouping rule to group all alerts by department.
   • DKeep the incident as is and handle both campaigns together.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An incident is created from an alert about a user logging in from an unusual location. The analyst wants the incident to include the user's risk score, the device's compliance status, and any other alerts involving the same user. What should the analyst use in XSIAM?

   • AIncident data enrichment to pull context from identity, device, and alert sources.
   • BManual entry of all context into the incident notes.
   • CThe incident closure report that summarizes the investigation.
   • DThe alert's raw log only, which contains all necessary context.
   Reveal Solution Discussion Select an answer first