What is the primary benefit of creating indicators via playbooks?

It requires less technical skill than manual creation

It allows for manual review of each indicator

It eliminates the need for indicator types

It enables automated and consistent indicator creation

Which of the following is a bulk method for creating indicators in XSOAR?

Using the Create Indicator button on the Indicators page

Calling the API to create one indicator

Using a playbook to create an indicator

Uploading a CSV file through the Import Indicators option

When importing indicators from a CSV file in XSOAR, what must be done to ensure the data is correctly interpreted?

The file must be uploaded to the Incidents page

The file must contain only IP addresses

The file must be in JSON format

The CSV columns must be mapped to XSOAR indicator fields

A security operations center (SOC) receives a weekly threat feed in CSV format with columns: 'ip', 'domain', 'hash', and 'notes'. The SOC wants to import this file into XSOAR, but the file contains a mix of indicator types in separate columns. What is the correct way to handle this import?

Manually create each indicator from the CSV, copying the values into the web interface.

Use the bulk import feature and map the 'ip' column to the IP indicator type, the 'domain' column to the Domain type, and the 'hash' column to the File type.

Import the CSV as-is, and XSOAR will automatically detect the type of each indicator based on the column name.

Split the CSV into separate files, one for each indicator type, and import each file separately with the appropriate field mapping.

Which of the following is a typical authentication method for the XSOAR API?

Username and password in the URL

OAuth2 token from a third-party provider

Palo Alto NetworksCertified XSOAR Engineer

Domain 5Objective 2

5.2 Explain Indicator Creation Methods XSOAR-ENGINEER Practice Questions (Page 1)

Part of the Threat Intelligence Management domain, which accounts for 18% of the XSOAR-ENGINEER exam.

26questions here

6free pages

7concepts

18%of the exam

Questions 1–5

1foundation · easy
What is the primary benefit of creating indicators via playbooks?
Select an answer first
2foundation · easy
Which of the following is a bulk method for creating indicators in XSOAR?
Select an answer first
3foundation · easy
When importing indicators from a CSV file in XSOAR, what must be done to ensure the data is correctly interpreted?
Select an answer first
4application · medium
A security operations center (SOC) receives a weekly threat feed in CSV format with columns: 'ip', 'domain', 'hash', and 'notes'. The SOC wants to import this file into XSOAR, but the file contains a mix of indicator types in separate columns. What is the correct way to handle this import?
Select an answer first
5foundation · easy
Which of the following is a typical authentication method for the XSOAR API?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XSOAR-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSOAR-ENGINEER” is a trademark of its owner, used for identification only.