XSIAM-Analyst Alerting And Detection Processes Practice Question
An organization wants to reduce noise from a known vulnerability scanner that triggers high-severity analytics alerts every weekend. The SOC decides to suppress these specific alerts during scanning windows. How should the analyst configure this in XSIAM?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Exclusion or Suppression rule in the Incident and Alert Settings with time-based criteria.
Alert suppression rules can be configured with specific time schedules and filter criteria to mute known benign scanner activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an Exclusion or Suppression rule in the Incident and Alert Settings with time-based criteria.
Why this is correct
XSIAM supports suppression rules that can filter out alerts matching specific signatures and time schedules.
- ✗
Modify the firewall security policy to block the scanner IP.
Why it's wrong here
Blocking the scanner would disrupt vulnerability management operations rather than suppressing XSIAM alert noise.
- ✗
Configure a global severity override to change the scanner alerts to 'Informational' permanently.
Why it's wrong here
Permanently lowering severity would hide genuine issues if the scanner runs outside its window or compromises are missed.
- ✗
Delete the underlying log source parser during the scanner execution window.
Why it's wrong here
Deleting parsers stops log ingestion entirely, which causes blind spots and parsing errors.
About these practice questions
One of 170 original XSIAM-Analyst practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XSIAM-Analyst practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XSIAM-Analyst exam.