5.7 Demonstrate Understanding of Indicator Exclusions List Configuration and Management XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst needs to add a known benign IP address (203.0.113.10) to the indicator exclusions list so that it is not blocked by XSOAR. The analyst wants to ensure the exclusion is effective immediately and applies to all future processing. What should the analyst do?

   • AAdd the IP address to the blocked indicators list with a comment 'benign'.
   • BCreate a new indicator field named 'excluded' and set it to true for the IP address.
   • CNavigate to the indicator exclusions list and add the IP address with the appropriate source and expiration settings.
   • DModify the threat intelligence feed configuration to ignore this IP address.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When adding an indicator to the exclusions list in XSOAR, which attribute is essential to specify?

   • AThe indicator's expiration date
   • BThe indicator's type (e.g., IP, domain, URL)
   • CThe indicator's reputation score
   • DThe indicator's source feed name
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team has an indicator exclusions list that is used to prevent internal IPs from being blocked. Recently, a new threat intelligence feed was added that flags one of these internal IPs as malicious. The team wants to ensure that the internal IP remains excluded, but they also want to see the threat intelligence data for that IP for analysis. What should they do?

   • ADisable the new threat intelligence feed.
   • BRemove the IP from the exclusions list to allow enrichment.
   • CChange the IP's indicator type to 'benign'.
   • DKeep the IP in the exclusions list and manually review the feed data for that IP.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What does 'disabling' an entry in the indicator exclusions list do?

   • AIt permanently removes the entry from the list
   • BIt automatically re-enables the entry after a set period
   • CIt makes the entry inactive without deleting it, so it can be re-enabled later
   • DIt changes the indicator's type to a different format
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team has an indicator exclusions list that contains several entries that are no longer needed. The team wants to clean up the list to reduce confusion and ensure that only current exclusions are active. What is the best practice for managing these obsolete entries?

   • ADelete the obsolete entries from the list.
   • BExport the list and remove the entries from the exported file.
   • CLeave them in the list but mark them as inactive.
   • DEdit the entries to have a future expiration date.
   Reveal Solution Discussion Select an answer first