Palo Alto Networks Certified Detection and Remediation Analyst (PCDRA) — Question 46

While working the alerts involved in a Cortex XDR incident, an analyst has found that every alert in this incident requires an exclusion. What will the Cortex XDR console automatically do to this incident if all alerts contained have exclusions?

Answer options

• A. mark the incident as Unresolved
• B. create a BIOC rule excluding this behavior
• C. create an exception to prevent future false positives
• D. mark the incident as Resolved – False Positive

Correct answer: D

Explanation

The Cortex XDR console marks the incident as Resolved – False Positive when all alerts are found to require exclusions, indicating that these alerts do not represent genuine threats. The other options are incorrect because they either suggest ongoing unresolved issues or actions that do not apply in this scenario.