Exam PCDRA topic 1 question 49 discussion

You can manually star an INCIDENT but you also can add an starring ALERT configuration. I checked the Cortex XDR to double check, and "AD" are the right choices.

From stduy guıde: You can star incidents in two ways: You can manually star an incident after reviewing it, or you can create an incident-starring configuration that automatically categorizes and stars incidents when a related alert contains the specific attributes that you decide are important.

AD for sure

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Manage-Incident-Starring You can manually star an incident after reviewing it, or you can create an incident starring configuration that automatically categorizes and stars incidents when a related alert contains the specific attributes that you decide are important.

The correct answer is B and D. From the Study Guide. Incident related starring

AD: You can star incidents in two ways: You can manually star an incident after reviewing it, or you can create an incident starring configuration

I am confused here, the documentation says to create an incident starring configuration, but in the configuration setting it says "Create New Alert Starring Configuration"

I guess B and D are correct.

You can manually star an incident after reviewing it, or you can create an incident starring configuration that automatically categorizes and stars incidents when a related alert contains the specific attributes that you decide are important. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Manage-Incident-Starring

can manually star incident and using Starred Alerts rule under Incident Configuration