Cybersecurity-Apprentice Security Operations Practice Question
An organization experiences an alert spike from a misconfigured internal vulnerability scanner mimicking a port scan attack. How can a security analyst suppress or tune this specific alert in Cortex XDR to reduce false positives?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an exception rule in Cortex XDR using the alert details to filter out the scanner's specific parameters.
Cortex XDR allows analysts to tune alerts by creating exception rules based on alert criteria such as specific hosts, file paths, or command lines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the default Security Policy rule on the firewall governing internal subnets.
Why it's wrong here
Deleting internal firewall policies disrupts legitimate internal network routing and communications.
- ✗
Disable the entire Local Analysis module globally across all endpoint security profiles.
Why it's wrong here
Disabling Local Analysis globally would severely weaken endpoint protection against real malware.
- ✗
Restart the Cortex XDR Agent daemon on the vulnerability scanner host.
Why it's wrong here
Restarting the agent does not prevent future false positive alerts from being generated.
- ✓
Create an exception rule in Cortex XDR using the alert details to filter out the scanner's specific parameters.
Why this is correct
Exception rules allow tuning by excluding known benign activity matching specific indicators.
About these practice questions
Courseiva writes every Cybersecurity-Apprentice question from scratch — 177 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This Cybersecurity-Apprentice practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the Cybersecurity-Apprentice exam.