6.1 Import and Manage Indicators XSIAM-ANALYST Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   An analyst notices that an indicator for a known malicious domain has been automatically marked as 'expired' in XSIAM. The analyst did not manually change the status. What is the most likely reason for this automatic status change?

   • AThe indicator was revoked by the threat intelligence source.
   • BThe indicator failed validation during a routine check.
   • CThe indicator's expiration date was reached.
   • DThe indicator was automatically deleted and re-created.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   During an import, XSIAM identifies that an indicator with the same value already exists in the system. What is this situation called?

   • AExpired indicator
   • BEnriched indicator
   • CRevoked indicator
   • DDuplicate indicator
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   An analyst imports a CSV file with 10,000 indicators. After the import, the analyst notices that 500 indicators were marked as 'skipped' in the import log. Upon investigation, the analyst finds that these indicators have the same values as existing indicators but with different metadata (e.g., a different source). The analyst wants to update the existing indicators with the new source information without creating duplicates. What should the analyst do?

   • ADelete the existing indicators and re-import the CSV file.
   • BUse the conflict resolution feature to merge the new source information into the existing indicators.
   • CModify the CSV file to remove the duplicate values and re-import it.
   • DManually edit each of the 500 existing indicators to add the new source.
   Reveal Solution Discussion Select an answer first