2.1 Demonstrate Understanding of Incident and Indicator Lifecycles XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst manually adds an IP address to XSOAR as an indicator after seeing it in a threat report. The playbook automatically queries multiple threat intelligence sources to gather additional context, such as geolocation and associated malware. Which indicator lifecycle stage is the playbook performing?

   • ACreation
   • BDetection
   • CExpiration
   • DEnrichment
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A threat intelligence team receives a feed of indicators from an external source. Some indicators are known to be malicious, while others are only suspicious and need further analysis. The team wants to automatically enrich all indicators, but only block the ones confirmed as malicious. Which approach is most appropriate?

   • ABlock all indicators immediately
   • BExpire all indicators after enrichment
   • CManually review every indicator before enrichment
   • DEnrich all indicators, then use a playbook to block only those with a malicious verdict
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is handling a data breach. The incident has been contained, but the team is unsure if the attacker is still present in the environment. They need to perform a thorough investigation to ensure the threat is fully eradicated before restoring systems. Which incident lifecycle stage should they focus on?

   • ARecovery
   • BEradication
   • CPost-incident activity
   • DDetection
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A playbook is configured to automatically set an expiration date of 90 days for all indicators added during incident response. After 90 days, the indicators are automatically removed from the active indicator list. What is the purpose of this configuration?

   • ATo enrich indicators with more context
   • BTo reduce false positives from stale indicators
   • CTo ensure indicators are never deleted
   • DTo increase the number of indicators in the system
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which activity is typically performed during the post-incident stage of the incident lifecycle?

   • ALessons learned review
   • BEradication of the root cause
   • CContainment of the threat
   • DInitial detection of the incident
   Reveal Solution Discussion Select an answer first