What is the Palo Alto Networks default Prisma Cloud setting for Alert Disposition to reduce the number of false positives?

The correct answer is A. Conservative. Conservative is the default Alert Disposition in Prisma Cloud because it applies the strictest confidence thresholds before triggering an alert, meaning only high-certainty anomalies generate notifications - directly minimizing false positives in environments where alert…

Threat Detection and Anomaly Policies

Question

Options

AConservative
BModerate
CHigh
DAggressive

How the community answered

(37 responses)

A
89% (33)
B
3% (1)
C
5% (2)
D
3% (1)

Explanation

Conservative is the default Alert Disposition in Prisma Cloud because it applies the strictest confidence thresholds before triggering an alert, meaning only high-certainty anomalies generate notifications - directly minimizing false positives in environments where alert fatigue is a real operational concern.

Why the distractors are wrong:

B. Moderate is a valid option users can select, but it represents a middle-ground sensitivity and is not the default.
C. High is not a named Alert Disposition tier in Prisma Cloud - it describes a severity level, not a disposition setting, making it a classic misdirection.
D. Aggressive is the opposite of what's needed to reduce false positives; it casts the widest net, flagging more edge-case behavior and generating more noise, not less.

Memory tip: Think "conservative = cautious = careful about crying wolf." Just as a conservative person avoids overreacting, Prisma Cloud's Conservative disposition avoids over-alerting - and defaults to that posture out of the box.

Topics

#alert disposition#false positives#UEBA#Prisma Cloud settings

Community Discussion

No community discussion yet for this question.

Full PSE-PRISMACLOUD Practice