2.1 Explain the Incident Creation Process XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the correct sequence of stages in the incident lifecycle within XSIAM?

   • AInvestigation, creation, triage, containment, eradication, recovery, closure
   • BCreation, triage, investigation, containment, eradication, recovery, closure
   • CCreation, investigation, triage, containment, eradication, recovery, closure
   • DTriage, creation, investigation, containment, recovery, eradication, closure
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An incident is automatically created from a high-severity alert. The SOC team wants to ensure that the incident is automatically assigned to the senior analyst on duty and that a notification is sent to the team's chat channel. What should be configured in XSIAM?

   • AA playbook that runs on incident creation to assign the incident and send the notification.
   • BA report that lists all new incidents so the analyst can check it manually.
   • CAn alert enrichment rule that adds the analyst's name to the incident.
   • DA manual assignment step that the analyst must perform after the incident is created.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a typical criterion used to group alerts into a single incident in XSIAM?

   • ASame timestamp to the second
   • BSame analyst assigned
   • CSame source IP address
   • DSame alert ID
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In XSIAM, how is the severity of an incident primarily determined?

   • ABased on the analyst's personal judgment
   • BBased on the time of day the incident occurred
   • CBased on the impact and urgency of the incident
   • DBased on the number of alerts in the incident
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An alert fires for a malware detection on a single endpoint that is not business-critical. The malware is known to be low-impact and easily contained. According to XSIAM's incident severity assignment logic, what should the incident severity be?

   • AMedium, because malware is always medium severity.
   • BCritical, because the alert was generated automatically.
   • CLow, because the affected asset is not critical and the impact is minimal.
   • DHigh, because any malware detection is always high severity.
   Reveal Solution Discussion Select an answer first