5.5 Demonstrate Knowledge of Indicator Enrichment and Source Reliability XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of using multiple enrichment sources for an indicator?

   • ATo replace the need for manual analysis by security analysts
   • BTo increase the volume of data stored in the threat intelligence platform
   • CTo provide a more complete picture of the indicator's context and validity
   • DTo ensure all indicators are automatically blocked across all security tools
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An XSOAR playbook enriches a file hash and receives a 'malicious' verdict from a high-reliability source and a 'benign' verdict from a low-reliability source. The playbook is configured to automatically block files with high confidence. What should the playbook do?

   • AFlag the file for manual review without blocking.
   • BBlock the file because the high-reliability source says it is malicious.
   • CBlock the file only if both sources agree.
   • DDo not block the file because the low-reliability source says it is benign.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A threat intelligence team is evaluating two enrichment sources. Source A has been highly accurate for two years but has a 24-hour delay in updates. Source B has been accurate for only three months but provides real-time updates. The team needs to enrich indicators for a zero-day campaign that is evolving rapidly. Which source should the team rely on more heavily?

   • ASource A, because its long track record makes it more reliable.
   • BUse both sources equally, as they balance each other out.
   • CUse neither source and rely on manual analysis.
   • DSource B, because real-time updates are essential for zero-day campaigns.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In the enrichment process, what is the purpose of aggregating results from multiple sources?

   • ATo automatically block the indicator across all security tools
   • BTo reduce the number of queries sent to each source
   • CTo delete duplicate indicators from the database
   • DTo combine data from different sources into a single coherent view
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A threat intelligence team is evaluating two enrichment sources for IP reputation. Source A has a 99% accuracy rate but updates its database only once a week. Source B has a 95% accuracy rate but updates in near real-time. An analyst needs to enrich a fast-spreading phishing campaign indicator. Which source should the analyst prioritize?

   • ASource A, because higher accuracy is always more important.
   • BSource B, because timeliness is more critical for an active campaign.
   • CUse neither source and rely on internal data only.
   • DUse both sources equally without prioritization.
   Reveal Solution Discussion Select an answer first