5.7 Demonstrate Understanding of Indicator Exclusions List Configuration and Management XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company uses XSOAR to automate response actions, including blocking malicious IPs. They have a partner organization that occasionally uses IP addresses that are also listed in threat intelligence feeds as malicious. The company wants to ensure that these partner IPs are not blocked, but they still want to see them in the indicator database for reference. What should they do?

   • ASet the partner IPs to a 'benign' reputation score.
   • BAdd the partner IPs to the indicator exclusions list.
   • CCreate a separate incident type for partner IPs.
   • DRemove the partner IPs from all threat intelligence feeds.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has an indicator exclusions list that includes several domains used for internal testing. A new threat intelligence feed is added that flags these domains as malicious. The team wants to ensure that the domains are not blocked, but they also want to be alerted if the domains are seen in the wild. What is the best approach?

   • ARemove the domains from the exclusions list to allow alerting.
   • BDisable the new threat intelligence feed.
   • CKeep the domains in the exclusions list and create a separate alert rule for these domains.
   • DChange the domains to a 'low' reputation score.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company has a list of internal domains that are used for development. These domains are frequently flagged by external threat feeds. The team wants to ensure that these domains are not enriched or processed by threat intelligence, but they still want to see them in the indicator database. What is the best approach?

   • ASet the domains to a 'low' reputation score.
   • BAdd the domains to the indicator exclusions list.
   • CCreate a new indicator type for internal domains.
   • DRemove the domains from the threat intelligence feeds.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A managed security service provider (MSSP) uses XSOAR to manage multiple clients. One client has a list of IP addresses that are used for legitimate scanning and should never be blocked. Another client has a similar list but with different IPs. The MSSP wants to ensure that each client's exclusions are applied only to their own environment. What is the best way to achieve this?

   • AUse a single global exclusions list with all IPs from all clients.
   • BUse a single list and rely on the incident owner to manually skip blocking for the correct client.
   • CCreate separate exclusions lists for each client and apply them in the relevant incident or playbook context.
   • DAdd all IPs to the global list but tag them with the client name.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which action is part of managing the indicator exclusions list in XSOAR?

   • AChanging the indicator's type after it has been added
   • BDeleting an exclusion entry that is no longer needed
   • CAutomatically adding all new indicators to the list
   • DExporting the list to a third-party threat intel platform
   Reveal Solution Discussion Select an answer first