5.5 Demonstrate Knowledge of Indicator Enrichment and Source Reliability XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An XSOAR playbook enriches an email address indicator. The playbook queries three sources and receives results with different reliability scores. After aggregating the results, the playbook must update the indicator's context. What is the final step in the enrichment process?

   • AAssign a confidence score based on the reliability of the sources.
   • BAutomatically block the email address if any source flags it.
   • CQuery additional sources to confirm the results.
   • DUpdate the indicator's context with the raw results.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of applying a reliability scoring system to enrichment sources?

   • ATo ensure all sources receive equal weight in analysis
   • BTo reduce the number of sources used in enrichment
   • CTo rank sources so that data from more reliable sources is given higher priority
   • DTo automatically block indicators from low-scoring sources
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An XSOAR playbook enriches a URL indicator. The playbook queries three sources: Source 1 (reliability 90) returns 'malicious', Source 2 (reliability 80) returns 'suspicious', Source 3 (reliability 70) returns 'benign'. The playbook must update the indicator's context. How should the playbook determine the final reputation?

   • ACalculate a weighted score based on reliability and verdicts.
   • BSet the reputation to 'unknown' because the sources disagree.
   • CTake the verdict from the source with the highest reliability score.
   • DTake the most common verdict among the sources.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of an internal database used to enrich an indicator?

   • AA government-provided list of known malicious domains
   • BA commercial threat intelligence feed that provides real-time malware hashes
   • CAn organization's own incident response case management system
   • DA public reputation service that scores IP addresses based on observed activity
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team wants to enrich indicators using a mix of internal and external sources. They have an internal database of past incidents, a commercial threat intelligence feed, and access to a free open-source reputation service. What is the most effective way to use these sources?

   • AQuery all three sources and aggregate the results.
   • BUse the commercial feed as the primary source and ignore the others to save time.
   • CUse the internal database only to avoid external dependency.
   • DUse the open-source service as the primary source because it is free.
   Reveal Solution Discussion Select an answer first