Palo Alto Networks Certified Security Automation Engineer (PCSAE)Incident ManagementEasy
A security operations center (SOC) manager wants to ensure that all critical incidents are reviewed by a senior analyst before closure. Which Cortex XSOAR incident lifecycle stage is most appropriate for implementing this review gate?
- ATriage
- BContainment
- CResolution
- DPost-Incident Analysis
Show answer & explanationAnswer & explanation
Correct answer: C. Resolution
The Resolution stage in Cortex XSOAR is where the incident is determined to be remediated and is awaiting final verification before closure. This is the ideal point to introduce a senior analyst review to ensure all actions were completed correctly.
Why the other options are wrong
- A. Triage is for initial assessment and categorization, not final review before closure.
- B. Containment focuses on limiting the impact of the incident, not on final review.
- D. Post-Incident Analysis occurs after the incident is closed and focuses on lessons learned, not on preventing premature closure.
Incident Lifecycle - Resolution
The Resolution stage in Cortex XSOAR indicates that an incident has been remediated and is awaiting final verification or closure. It's a critical point for quality control before archiving.
- Occurs after containment and eradication.
- Verifies that the incident's root cause has been addressed.
- Often involves stakeholder sign-off or final checks.
- Precedes the closure or post-incident analysis phase.
Memory trick: TRCPR: Triage, Respond, Contain, Resolve, Post-mortem.