5.5 Demonstrate Knowledge of Indicator Enrichment and Source Reliability XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An organization uses a reliability scoring system where scores are updated quarterly. Source A had a score of 90 last quarter, but this quarter it has been involved in several false positives. Source B has a score of 85 and has been consistently accurate. An analyst is enriching an indicator and receives conflicting results from Source A and Source B. How should the analyst weigh the sources?

   • ATrust Source A because its score is higher.
   • BTrust Source B because it has been consistently accurate recently.
   • CIgnore both sources and use manual analysis.
   • DTrust both equally because scores are similar.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the correct sequence of steps in the indicator enrichment process?

   • AUpdate context, query sources, aggregate results
   • BQuery sources, update context, aggregate results
   • CQuery sources, aggregate results, update context
   • DAggregate results, query sources, update context
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An XSOAR playbook enriches an IP address. Source A (reliability 95) says 'malicious', Source B (reliability 60) says 'benign'. The playbook is configured to block IPs with high confidence. What should the playbook do?

   • ADo not block the IP because the low-reliability source says benign.
   • BFlag the IP for manual review without blocking.
   • CBlock the IP only if both sources agree.
   • DBlock the IP because the high-reliability source says malicious.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is source reliability important when deciding whether to block an indicator?

   • ABlocking decisions should be based solely on the indicator type, not the source
   • BBlocking based on unreliable sources can lead to false positives and disrupt legitimate operations
   • CReliable sources always provide indicators that are safe to ignore
   • DSource reliability only matters for internal databases, not external feeds
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC analyst is enriching a URL indicator. The analyst wants to include data from internal threat intelligence, external commercial feeds, and open-source reputation services. What is the primary benefit of using this combination of sources?

   • AIt ensures the indicator is automatically blocked across all security controls.
   • BIt reduces the number of false positives because internal data is always more accurate.
   • CIt eliminates the need for manual analysis.
   • DIt provides a more complete picture of the indicator's reputation and context.
   Reveal Solution Discussion Select an answer first