5.4 Explain Indicator Relationships XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An analyst observes two distinct IP addresses that are both used as C2 servers for the same malware family but have no direct interaction with each other. Which relationship type best describes the connection between these two IP addresses?

   • APeer relationship
   • BSource-target relationship
   • CDerived relationship
   • DParent-child relationship
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A threat intel platform shows a relationship between an IP address and a domain. The relationship is based on a single passive DNS record that has not been updated in 18 months. An analyst needs to assess the confidence of this relationship. What is the most appropriate confidence level?

   • ANo confidence, because passive DNS is never reliable
   • BMedium confidence, because the record is old but still valid
   • CHigh confidence, because passive DNS is a reliable source
   • DLow confidence, because the evidence is stale and uncorroborated
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is investigating a newly discovered domain that has a relationship to a known malicious IP. The relationship is marked as 'peer' with high confidence. How should the analyst use this relationship for enrichment?

   • AIgnore the relationship because peer relationships are not useful for enrichment
   • BTreat the domain as malicious because it shares a peer relationship with a known bad IP
   • CUse the relationship to prioritize the domain for further investigation
   • DImmediately block the domain without further analysis
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An analyst is investigating a domain that has a relationship with a known phishing kit. How can this relationship enrich the analyst's understanding of the domain?

   • AIt shows the domain is unrelated to any threat activity
   • BIt confirms the domain is safe for internal users
   • CIt indicates the domain is likely used for phishing campaigns
   • DIt proves the domain is owned by a legitimate organization
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   In a threat intelligence graph, a malware hash has an incoming edge labeled 'dropped by' from a document hash. What is the directionality of this relationship?

   • ABoth are sources and targets of each other
   • BThe malware hash is the source, and the document hash is the target
   • CThe document hash is the source, and the malware hash is the target
   • DThe relationship is undirected
   Reveal Solution Discussion Select an answer first