5.5 Demonstrate Knowledge of Indicator Enrichment and Source Reliability XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–21

1. 21expert · hard

   A security operations team is designing an enrichment process for a new XSOAR deployment. They have access to a commercial feed with high reliability, an open-source feed with moderate reliability, and an internal database with high reliability but limited coverage. The team needs to enrich indicators for both external and internal threats. What is the best strategy?

   • AUse the commercial feed as the sole source to ensure high reliability.
   • BUse all three sources, with the commercial feed and internal database weighted higher due to reliability.
   • CUse the open-source feed as the primary source because it is free.
   • DUse the internal database as the sole source to focus on internal threats.
   Reveal Solution Discussion Select an answer first