XSIAM-Analyst Alerting And Detection Processes Practice Question
An analyst notices that an analytic alert is repeatedly firing for legitimate administrative activity (a false positive). Aside from custom prioritization, how can an analyst manage this specific alert instance to aid future investigations?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add analyst feedback and tag the alert instance as a false positive within the alert review workflow.
Analysts can add feedback, tags, or suppressions depending on the workflow, but tagging or documenting exclusions is key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the raw log from the underlying storage bucket via the UI.
Why it's wrong here
Raw logs cannot and should not be deleted via the UI for false positives.
- ✗
Disable the Cortex XDR agent on the administrator's workstation.
Why it's wrong here
Disabling the agent removes protection entirely.
- ✗
Change the XDM mapping of the source log parser to omit the user account.
Why it's wrong here
Modifying parsers for false positives is incorrect and risks breaking schema normalization.
- ✓
Add analyst feedback and tag the alert instance as a false positive within the alert review workflow.
Why this is correct
Providing feedback and tagging helps train analytic tuning and records the analyst's determination.
About these practice questions
One of 170 original XSIAM-Analyst practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XSIAM-Analyst practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XSIAM-Analyst exam.