CCNA Alert Lifecycle And Incident Correlation Questions — Page 2 of 2

MCQmedium

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

A.Incident score range filter

B.Starred incidents filter

C.Featured fields filter

D.Data stitching status filter

AnswerB

The Starred filter isolates incidents flagged with the bookmark/star marker, which is shared across SOC users in the tenant. Applying it restricts the Incident View to team-bookmarked entries only, matching the requirement to see solely analyst-flagged incidents.

Why this answer

Cortex XDR's Incident View includes a 'Starred' filter that shows only incidents bookmarked by analysts. Applying this filter narrows the grid to starred incidents, which is exactly what the SOC team needs to see bookmarked cases. It is a first-class filter criterion in the incident grid's filter panel.

Exam trap

XDR-Analyst often tests the confusion between filtering by starred status versus filtering by featured fields or score — candidates pick a display or scoring filter when the question explicitly asks about bookmarked incidents.

How to eliminate wrong answers

Option A is wrong because an incident score range filter narrows by numeric severity, not by bookmark status. Option C is wrong because featured fields control which columns are displayed, not which incidents are shown based on starring. Option D is wrong because data stitching status relates to correlation state, not analyst bookmarks.

Practice this question →

MCQhard

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

A.Configure exclusions for the vulnerability scanner's IP addresses or signature patterns

B.Enable featured fields to hide scanner columns

C.Turn off data stitching across all internal subnets

D.Star all alerts generated during scanning windows

AnswerA

Exclusions suppress matching scanner traffic before it generates raw alerts, so benign scans never merge into incidents or inflate severity. This directly satisfies the stem's constraint of preventing vulnerability scanner activity from corrupting incident lifecycles, rather than merely tuning severity thresholds after the fact.

Why this answer

Creating exclusion rules for scanner IP addresses or signatures ensures vulnerability assessment traffic does not trigger security incidents.

Practice this question →

MCQmedium

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

A.Incident scoring weight profiles

B.Featured fields settings

C.Alert exclusion rule manager

D.Data stitching correlation parameters

AnswerB

Featured fields settings control which columns appear in the incident queue, so adding 'OS Version' there satisfies the requirement to display it for all incidents. This is the dedicated customisation surface for queue columns, unlike filtering, grouping or saved-query options, which alter which incidents appear rather than which attributes are shown.

Why this answer

Featured fields configuration allows administrators to add standard or custom attributes like OS Version as columns in the incident table.

Practice this question →

MCQeasy

An analyst needs to quickly identify all incidents in Cortex XDR that are related to a specific MITRE ATT&CK technique, such as T1059 (Command and Scripting Interpreter). What is the most efficient way to find these incidents?

A.Apply a filter on the Incidents page for the 'MITRE ATT&CK' field and select the desired technique.

B.Run a query in the Query Builder using the 'mitre_technique_id' field.

C.Create a custom dashboard widget that counts incidents by MITRE technique.

D.Use the search bar on the Incidents page and type the technique ID.

AnswerA

The Incidents page provides filters, including one for MITRE ATT&CK tactics and techniques. By filtering on the specific technique, the analyst can instantly see all incidents that have alerts mapped to that technique. This is the intended and most efficient method to isolate incidents by ATT&CK technique.

Why this answer

The Incidents page in Cortex XDR includes a filter for MITRE ATT&CK tactics and techniques. Applying this filter allows the analyst to view only incidents that contain alerts mapped to the selected technique. This is the most direct and efficient way to find all relevant incidents without manual searching or querying.

Exam trap

The trap here is confusing alert-level search with incident-level filtering; the Incidents page has a dedicated MITRE ATT&CK filter, while the search bar does not index technique IDs.

Practice this question →

MCQhard

An analyst is triaging a Cortex XDR incident that contains a mix of high and low severity alerts. The analyst wants to quickly identify which alerts are most critical to address first. Which column in the Incident View's Alerts tab should the analyst sort by to prioritize alerts based on their potential impact?

A.Timestamp

B.Severity

C.Alert Name

D.Endpoint Name

AnswerB

The Severity column reflects the alert's assessed severity level (e.g., High, Medium, Low) based on the analytics and threat intelligence. Sorting by Severity allows the analyst to bring the most critical alerts to the top, enabling rapid prioritization. This is the most direct way to focus on high-impact alerts first.

Why this answer

The Severity column provides a quick, at-a-glance indication of how critical each alert is. By sorting descending on Severity, the analyst can immediately see and address the most severe alerts first, ensuring that high-impact threats are handled promptly. This aligns with standard triage practices of focusing on the highest risk items.

Exam trap

The trap here is assuming that chronological order (Timestamp) or endpoint grouping is the best way to prioritize; however, severity directly reflects the potential impact and is the primary sorting criterion for triage.

Practice this question →