While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?
A.
mark the incident as Unresolved
B.
create a BIOC rule excluding this behavior
C.
create an exception to prevent future false positives
The correct answer is not listed. The incident is marked as resolved - False Positive. This is the same question as Question 41.
Like Ninya69 said:
"If an incident contains only alerts with exclusions, Cortex XDR changes the incident status to Resolved - False Positive and sends an email notification to the incident assignee (if set)."
Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-an-Alert-Exclusion-Rule"
This section is not available anymore. Please use the main Exam Page.PCDRA Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Mmalacan
9 months, 1 week agoabd1234
10 months, 2 weeks agoLukinator
11 months, 2 weeks agonuna957
1 year ago