Practice question 80 of 498 · medium
After XDR integration, the SOC receives two incident records for the same component alerts. What should it inspect first?
Choose the single best answer.
Show the answer and explanation
✓ Correct answer
- Overlapping incident-creation rules and connector paths
Overlapping creation paths can produce two incidents for correlated alerts. Shorter raw-event retention affects evidence availability, ownership automation changes handling rather than creating the duplicate correlation path, and raw-table selection is distinct from incident duplication.
Read and review here, or open the app to practise and save your results on this device.
Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.