6.1 Import and Manage Indicators XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An XSIAM analyst needs to bring a list of known malicious IP addresses into the platform. Which method allows the analyst to manually add these indicators one by one through the user interface?

   • AManual entry
   • BAutomated feed
   • CFile upload
   • DAPI integration
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   An analyst imports a list of IP addresses from a new threat intelligence vendor. After import, the analyst wants to verify that the indicators are correctly formatted and have valid values. What should the analyst do?

   • ADelete the indicators and try a different file format.
   • BManually review each IP address in the indicator list.
   • CRe-import the file to see if the same errors occur.
   • DCheck the import log for any validation errors or warnings.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst imports a list of domains from an internal threat research team. After import, the analyst wants to ensure that these domains are checked against external threat intelligence to add reputation scores and related malware families. What should the analyst do?

   • ARe-import the domains with a different file format to trigger enrichment.
   • BConfigure XSIAM to enrich the indicators using its built-in threat intelligence integrations.
   • CDelete the domains and add them again with the enrichment data manually.
   • DManually look up each domain in an external threat intelligence portal.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of validating an imported indicator in XSIAM?

   • ATo add additional context from external sources
   • BTo automatically block all malicious indicators
   • CTo ensure the indicator is in the correct format and syntactically valid
   • DTo delete indicators that are no longer needed
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A threat analyst has imported a list of known-bad domains into XSIAM. One month later, the analyst discovers that one of the domains has been remediated and is now owned by a legitimate company. The analyst needs to ensure this domain no longer triggers alerts while preserving the record for audit purposes. What should the analyst do?

   • ADelete the indicator from the collection.
   • BChange the indicator's status to 'Revoked'.
   • CMove the indicator to a new collection named 'Inactive'.
   • DEdit the indicator's value to a benign domain.
   Reveal Solution Discussion Select an answer first