XDR-Analyst Alert Lifecycle And Incident Correlation Practice Question
Cortex XDR stitches together data from multiple telemetry sources to form a cohesive incident. An analyst notices that network logs from a third-party firewall are generating alerts, but they are not stitching correctly with the endpoint alerts for the same compromised host. What is the most likely cause of this stitching failure in the raw-alert-to-incident lifecycle?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The third-party firewall logs lack proper field mapping for endpoint IP or hostname identifiers required by the stitching engine.
Data stitching relies on consistent identifiers such as internal IP addresses, MAC addresses, or hostnames. Mismatched or missing identifiers in parsed logs prevent the Cortex XDR causality engine from linking network and endpoint events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The incident scoring threshold is set too high for network alerts to be included in endpoint-triggered incidents.
Why it's wrong here
Incident scoring determines severity and grouping priorities, but it does not prevent underlying data stitching based on identifiers.
- ✗
The alerts are in an 'Unassigned' status, which disables the causality engine.
Why it's wrong here
Alert status (Assigned, Unassigned, New) does not disable the data stitching or causality analysis engine.
- ✓
The third-party firewall logs lack proper field mapping for endpoint IP or hostname identifiers required by the stitching engine.
Why this is correct
Stitching fails when key identifiers like IP addresses or hostnames do not match or are not correctly parsed into standard schema fields.
- ✗
Alert starring has not been applied to the network alerts, preventing automated correlation.
Why it's wrong here
Starring is a manual user interface action and has no impact on automated backend data stitching.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
This XDR-Analyst question is part of Courseiva's 210-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XDR-Analyst practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XDR-Analyst exam.