XDR-ANALYST practice question 10 of 35
Which two processes occur when an analyst stars an alert? (Choose two)
Full set: 100 questionsStarring an alert in the Cortex XDR console is a workflow management feature for analysts. When an alert is starred, it is marked with a star icon, making it easy to find again using the filter options in the alerts table. This allows an analyst to flag alerts of interest for follow-up. Consequently, by filtering for starred alerts, an analyst creates a prioritized view of items they are actively investigating or need to return to, separating them from the general queue of incoming alerts.
C. The alert’s severity is permanently changed: Starring is a non-destructive, user-specific flag for organization; it does not modify the underlying properties or severity of the alert itself.
D. The alert is deleted after 7 days: Starring is for bookmarking and prioritizing alerts, not for marking them for deletion or managing their lifecycle.
Palo Alto Networks. (2023). Cortex XDR Analyst Guide. "Manage Alerts". The guide explains the function of starring alerts: "Star an alert to easily locate it later. You can filter the alerts table to display only starred alerts." This directly supports options A and B as the purpose of easy retrieval is to create a prioritized view.
Keep practicing
Take the free XDR-ANALYST practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other XDR-ANALYST practice questions
- Question 1Which two scenarios best fit using pre-defined query templates? (Choose two)
- Question 2In XQL, which operator is used for field aliasing?
- Question 3Which advantage do query library entries provide in SOC operations?
- Question 4Which of the following alert sources can provide identity-based alerts?
- Question 5What type of report helps CISOs understand overall XDR performance?
- Question 6Which dashboard provides visibility into endpoint status, alert trends, and incident dist…
