5.5 Demonstrate Knowledge of Indicator Enrichment and Source Reliability XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is timeliness an important factor in assessing source reliability?

   • ABecause outdated information can lead to incorrect security decisions
   • BBecause timely sources require less storage space
   • CBecause timeliness is the only factor that matters for reliability
   • DBecause sources that respond faster are always more accurate
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does source reliability affect the confidence level of an indicator?

   • ASource reliability has no impact on confidence level
   • BIndicators from reliable sources are always considered false positives
   • CConfidence level is only based on the indicator type, not the source
   • DIndicators enriched from reliable sources are assigned a higher confidence level
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which factor is most important when assessing the reliability of an enrichment source?

   • AThe number of indicators the source has processed
   • BThe source's historical accuracy and timeliness
   • CThe source's cost to the organization
   • DThe source's user interface design
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is investigating a suspicious IP address that triggered an alert. The analyst wants to enrich the indicator using multiple sources to get a comprehensive view. Which approach should the analyst take to ensure the enrichment data is both comprehensive and reliable?

   • AQuery a single commercial threat intelligence feed that has a high reputation score.
   • BQuery multiple sources, including commercial feeds, open-source feeds, and internal databases, then aggregate the results.
   • CQuery only internal databases to avoid external data leakage.
   • DQuery the most recently updated feed only, regardless of source type.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization uses a scoring system to rank enrichment sources. Source A has a score of 90, Source B has a score of 80, and Source C has a score of 70. An analyst receives conflicting information about a domain: Source A says it is malicious, Source B says it is benign, and Source C says it is unknown. How should the analyst weigh the sources?

   • ATrust Source A because it has the highest reliability score.
   • BAverage the scores and decide based on the average.
   • CIgnore all sources and manually investigate the domain.
   • DTrust Source B because it is the most recent.
   Reveal Solution Discussion Select an answer first