Yes unresolved alerts can have their severity escalated is correct.

Many insider risk and security monitoring systems are designed to increase an alert's severity when it remains open and uninvestigated for a prolonged interval because continued lack of action can indicate an escalating threat or additional corroborating signals. Platforms typically factor elapsed time, new telemetry, and event correlation into risk scoring so the alert severity is raised to prompt attention from analysts.

Automatic escalation helps ensure that emerging incidents do not languish at a low priority and that analysts are guided to the most critical items. The exact thresholds and mechanisms for escalation vary by product and configuration so the timing you see in one system may differ from another.

No the alert severity remains the same is incorrect because keeping severity static despite new evidence or long unresolved status would risk missing an evolving incident and would contradict common designs in modern security operations where alerts can change state over time.

Full AWS Practitioner Certification Question