2.1 Explain the Incident Creation Process XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How do automation and playbooks contribute to incident creation in XSIAM?

   • AThey replace the need for human analysts entirely
   • BThey only generate reports after incidents are closed
   • CThey automatically create incidents and perform initial handling steps
   • DThey require manual approval for every incident creation
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of incident categorization and grouping in XSIAM?

   • ATo delete duplicate alerts automatically
   • BTo organize related alerts into a single incident for efficient handling
   • CTo assign a unique identifier to each alert
   • DTo encrypt alerts for secure storage
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An alert is generated by the XDR detection engine. According to the XSIAM incident creation workflow, what is the next step after the alert is generated?

   • AThe alert is evaluated by correlation and grouping rules to determine if it should be part of a new or existing incident.
   • BThe alert is sent to the ticketing system before incident creation.
   • CThe alert is immediately closed as a false positive.
   • DThe alert is manually reviewed by an analyst before any incident is created.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following correctly describes the sequence of steps in the incident creation workflow?

   • ATriage, alert generation, incident creation, enrichment
   • BAlert generation, incident creation, enrichment, triage
   • CIncident creation, alert generation, triage, enrichment
   • DEnrichment, alert generation, incident creation, triage
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company wants to automate the initial handling of incidents, but they have a requirement that only incidents with a severity of 'High' or above should trigger automated containment actions. Lower-severity incidents should only be assigned and notified. What should be configured in XSIAM?

   • AA single playbook that performs containment on all incidents.
   • BA playbook with conditional logic that checks severity before executing containment actions.
   • CA grouping rule that separates high and low severity incidents.
   • DA manual process where analysts decide on containment for each incident.
   Reveal Solution Discussion Select an answer first