exam questions

Exam PCDRA All Questions

View all questions & answers for the PCDRA exam

Exam PCDRA topic 1 question 39 discussion

Actual exam question from Palo Alto Networks's PCDRA
Question #: 39
Topic #: 1
[All PCDRA Questions]

Which of the following represents the correct relation of alerts to incidents?

  • A. Only alerts with the same host are grouped together into one Incident in a given time frame.
  • B. Alerts that occur within a three hour time frame are grouped together into one Incident.
  • C. Alerts with same causality chains that occur within a given time frame are grouped together into an Incident.
  • D. Every alert creates a new Incident.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
escar
Highly Voted 1 year, 12 months ago
Selected Answer: C
Alerts on the same causality chain are grouped with the same incident if an open incident already exists. Otherwise, the new incoming alert will create a new incident. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Investigate-Incidents
upvoted 5 times
...
abd1234
Most Recent 10 months, 3 weeks ago
Selected Answer: C
A is %100 wrong
upvoted 1 times
...
Chiquitabandita
1 year, 1 month ago
Selected Answer: C
found in the admin guide link
upvoted 1 times
...
GGP23
1 year, 2 months ago
Selected Answer: C
I vote C
upvoted 1 times
...
Flky
1 year, 7 months ago
Selected Answer: C
I vote C
upvoted 2 times
...
mogulmungi
1 year, 8 months ago
I vote C
upvoted 1 times
...
Davina07
1 year, 10 months ago
Selected Answer: C
I vote C
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago