A security team uses multiple threat intelligence feeds. One feed gives a file a 'malicious' verdict with high confidence, while another gives the same file a 'benign' verdict with medium confidence. What is the best approach?

Trust the high-confidence malicious verdict and block the file.

Investigate the file further to resolve the conflicting verdicts before taking action.

Set the verdict to 'unknown' and ignore both feeds.

Trust the benign verdict because it is from a more reputable feed.

Palo Alto NetworksCertified XSIAM Analyst

Domain 6Objective 4

6.4 Explain the Process of Verdict Management XSIAM-ANALYST Practice Questions (Page 6)

Part of the Threat Intelligence Management and ASM domain, which accounts for 20% of the XSIAM-ANALYST exam.

26questions here

6free pages

6concepts

20%of the exam

Questions 26–26

26expert · hard
A security team uses multiple threat intelligence feeds. One feed gives a file a 'malicious' verdict with high confidence, while another gives the same file a 'benign' verdict with medium confidence. What is the best approach?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to XSIAM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSIAM-ANALYST” is a trademark of its owner, used for identification only.

6.4 Explain the Process of Verdict Management XSIAM-ANALYST Practice Questions (Page 6)

Questions 26–26

A security team uses multiple threat intelligence feeds. One feed gives a file a 'malicious' verdict with high confidence, while another gives the same file a 'benign' verdict with medium confidence. What is the best approach?

Keep studying — Threat Intelligence Management and ASM