5.2 Explain Indicator Creation Methods XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security engineer is writing a script to create an indicator via the XSOAR API. The engineer wants to include custom fields such as 'confidence' and 'source'. What is the correct way to include these in the API request?

   • AAppend them to the 'value' field as a comma-separated list.
   • BInclude them as top-level fields in the JSON payload alongside 'type' and 'value'.
   • CCreate the indicator first, then make a separate API call to update the custom fields.
   • DSend them as query parameters in the API URL.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which file format is commonly used for bulk indicator import in XSOAR?

   • APDF
   • BCSV
   • CZIP
   • DEXE
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is it important to validate indicator data before or during creation?

   • ATo increase the indicator's reputation score
   • BTo make the indicator visible to all users
   • CTo automatically delete the indicator after 30 days
   • DTo ensure the indicator is in the correct format and type
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A threat intel team has a process where indicators are initially created with a 'Pending' status and then must be reviewed before being marked as 'Active'. An analyst has just manually created a new indicator. What is the next step in the indicator lifecycle?

   • AThe indicator is automatically enriched and set to 'Active' without any manual review.
   • BThe indicator is automatically deleted if it is not reviewed within 24 hours.
   • CThe indicator will remain 'Pending' forever unless a playbook is triggered to change it.
   • DThe analyst should manually change the status to 'Active' after verifying the indicator data.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A developer is building an integration that creates indicators in XSOAR via the API. The integration will be used by multiple teams, and each team has its own API key. The developer wants to ensure that indicators created by different teams are tagged with the team name for tracking. What is the best way to achieve this?

   • ACreate a playbook that automatically adds the team name based on the user who triggered the API call.
   • BAfter creating the indicator, manually edit it to add the team name.
   • CUse a separate XSOAR instance for each team to avoid mixing indicators.
   • DInclude a 'tag' field in the API payload with the team name, and have each team's script use its own tag.
   Reveal Solution Discussion Select an answer first