An administrator needs to add a large list of known safe file hashes to the indicator exclusions list. The list is in a CSV file with columns 'hash' and 'comment'. What is the most efficient way to add these hashes to the exclusions list?

Manually add each hash one by one through the XSOAR UI.

Use the XSOAR API or a script to bulk import the hashes.

Create a new indicator type for safe hashes and add them to that type.

Add the hashes to a threat intelligence feed and configure it as an exclusion source.

A security analyst added a domain to the indicator exclusions list six months ago because it was used by a marketing campaign. The campaign has ended, and the domain is now being used for malicious activity. The analyst needs to ensure that this domain is no longer excluded and can be processed normally. What should the analyst do?

Disable the exclusion entry and leave it in the list.

Remove the domain from the indicator exclusions list.

Edit the exclusion entry and change its expiration date to today.

Change the indicator type of the domain to 'malicious'.

What is the primary purpose of an indicator exclusions list in XSOAR?

To prevent certain indicators from being blocked or flagged during threat intelligence processing

To improve the performance of indicator enrichment by reducing the number of indicators processed

To automatically add new indicators to the block list

To permanently delete indicators from the threat intelligence database

In XSOAR, which of the following is a valid setting when adding an indicator to the exclusions list?

Setting the indicator to 'blocked' status

Specifying a comment to document the reason for exclusion

Assigning a new reputation score to the indicator

Configuring an automatic expiration for the exclusion

Palo Alto NetworksCertified XSOAR Engineer

Domain 5Objective 7

5.7 Demonstrate Understanding of Indicator Exclusions List Configuration and Management XSOAR-ENGINEER Practice Questions (Page 4)

Part of the Threat Intelligence Management domain, which accounts for 18% of the XSOAR-ENGINEER exam.

19questions here

4free pages

4concepts

18%of the exam

Questions 16–19

16application · medium
An administrator needs to add a large list of known safe file hashes to the indicator exclusions list. The list is in a CSV file with columns 'hash' and 'comment'. What is the most efficient way to add these hashes to the exclusions list?
Select an answer first
17application · medium
A security analyst added a domain to the indicator exclusions list six months ago because it was used by a marketing campaign. The campaign has ended, and the domain is now being used for malicious activity. The analyst needs to ensure that this domain is no longer excluded and can be processed normally. What should the analyst do?
Select an answer first
18foundation · easy
What is the primary purpose of an indicator exclusions list in XSOAR?
Select an answer first
19foundation · easy
In XSOAR, which of the following is a valid setting when adding an indicator to the exclusions list?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to XSOAR-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSOAR-ENGINEER” is a trademark of its owner, used for identification only.

5.7 Demonstrate Understanding of Indicator Exclusions List Configuration and Management XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–19

An administrator needs to add a large list of known safe file hashes to the indicator exclusions list. The list is in a CSV file with columns 'hash' and 'comment'. What is the most efficient way to add these hashes to the exclusions list?

What is the primary purpose of an indicator exclusions list in XSOAR?

In XSOAR, which of the following is a valid setting when adding an indicator to the exclusions list?

Keep studying — Threat Intelligence Management