5.7 Demonstrate Understanding of Indicator Exclusions List Configuration and Management XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst needs to add a list of IP addresses to the indicator exclusions list. The list includes both IPv4 and IPv6 addresses. The analyst wants to ensure that the exclusions are applied correctly for both types. What should the analyst do?

   • AConvert all IPv6 addresses to IPv4 before adding.
   • BAdd only the IPv4 addresses because IPv6 is not supported.
   • CAdd the IPs to a single entry using a comma-separated list.
   • DAdd each IP address individually, ensuring the correct format for IPv4 and IPv6.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the impact of an exclusion on an indicator's enrichment in XSOAR?

   • AThe indicator is not enriched, so it does not receive a reputation score
   • BThe indicator is enriched with additional threat intel from external feeds
   • CThe indicator is enriched but the score is manually overridden to 'benign'
   • DThe indicator is enriched only if it appears in more than one feed
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security administrator notices that an indicator that was previously excluded is now being blocked by XSOAR. The administrator checks the exclusions list and sees that the entry is still present. What could be the reason for this behavior?

   • AThe indicator type is not supported by the exclusions list.
   • BThe indicator was added to the exclusions list with the wrong source.
   • CThe exclusion entry has expired.
   • DThe exclusions list is full and cannot process new entries.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations team uses XSOAR to automatically block malicious indicators. They have a set of internal test domains that are used by their QA environment. These domains are not malicious, but they are being flagged by external threat feeds. The team wants to ensure that these domains are not blocked or flagged by XSOAR while still allowing all other indicators to be processed normally. What should the team do?

   • ACreate a new indicator type for the test domains.
   • BAdd the test domains to the indicator exclusions list.
   • CSet the test domains to a low reputation score in the indicator database.
   • DDisable the threat intelligence feeds that flag the test domains.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is configuring the indicator exclusions list and wants to add a domain that should be excluded only for a specific period of time (e.g., 30 days). What attribute should the analyst set when adding the domain?

   • AExpiration date
   • BSource
   • CComment
   • DReputation score
   Reveal Solution Discussion Select an answer first