In a relationship graph, a C2 domain has an outgoing edge to a sinkhole IP with the label 'sinkholed by'. The same C2 domain has an outgoing edge to a different IP with the label 'resolves to'. What is the most accurate interpretation?

The C2 domain is currently sinkholed and no longer resolves to the other IP

The sinkhole IP is a peer of the C2 domain

The C2 domain resolves to both IPs simultaneously

The C2 domain was sinkholed, and the 'resolves to' edge is likely historical

An analyst is investigating a new malware sample. The threat intel platform shows a parent-child relationship where the malware is the parent of a domain. The relationship has medium confidence. The analyst also finds that the domain is registered to a known threat actor. How should the analyst use this information?

Ignore the relationship because medium confidence is not sufficient

Use the relationship and registration to prioritize the domain for blocking

Investigate the domain further to confirm the relationship and its maliciousness

Conclude that the domain is malicious because it is related to the malware

During an incident investigation, an analyst identifies a suspicious IP address. By examining the relationships of this IP, the analyst discovers it is linked to a known malware family and a specific threat actor group. How does this enrichment help the analyst?

It provides additional context about the IP's role in the threat landscape

It automatically blocks the IP across all firewalls

It proves the IP is malicious beyond any doubt

It removes the IP from all threat intelligence feeds

An analyst is investigating a suspicious IP address. The threat intel platform shows a parent-child relationship where the IP is the parent of a domain. The relationship has low confidence. How should the analyst use this information?

Ignore the relationship because low confidence means it is irrelevant

Block the domain immediately to prevent potential threats

Treat the domain as malicious because it is related to a suspicious IP

Use the relationship as a lead to investigate the domain further

Palo Alto NetworksCertified XSOAR Engineer

Domain 5Objective 4

5.4 Explain Indicator Relationships XSOAR-ENGINEER Practice Questions (Page 2)

Part of the Threat Intelligence Management domain, which accounts for 18% of the XSOAR-ENGINEER exam.

18questions here

4free pages

5concepts

18%of the exam

Questions 6–10

6expert · hard
In a relationship graph, a C2 domain has an outgoing edge to a sinkhole IP with the label 'sinkholed by'. The same C2 domain has an outgoing edge to a different IP with the label 'resolves to'. What is the most accurate interpretation?
Select an answer first
7expert · hard
An analyst is investigating a new malware sample. The threat intel platform shows a parent-child relationship where the malware is the parent of a domain. The relationship has medium confidence. The analyst also finds that the domain is registered to a known threat actor. How should the analyst use this information?
Select an answer first
8foundation · easy
During an incident investigation, an analyst identifies a suspicious IP address. By examining the relationships of this IP, the analyst discovers it is linked to a known malware family and a specific threat actor group. How does this enrichment help the analyst?
Select an answer first
9foundation · easy
In XSOAR threat intelligence, a malware sample is observed to have been created by a specific threat actor group. The malware sample then communicates with a command-and-control (C2) domain. Which relationship type best describes the link between the threat actor group and the malware sample?
Select an answer first
10application · medium
An analyst is investigating a suspicious IP address. The threat intel platform shows a parent-child relationship where the IP is the parent of a domain. The relationship has low confidence. How should the analyst use this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XSOAR-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSOAR-ENGINEER” is a trademark of its owner, used for identification only.

5.4 Explain Indicator Relationships XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

In a relationship graph, a C2 domain has an outgoing edge to a sinkhole IP with the label 'sinkholed by'. The same C2 domain has an outgoing edge to a different IP with the label 'resolves to'. What is the most accurate interpretation?

During an incident investigation, an analyst identifies a suspicious IP address. By examining the relationships of this IP, the analyst discovers it is linked to a known malware family and a specific threat actor group. How does this enrichment help the analyst?

In XSOAR threat intelligence, a malware sample is observed to have been created by a specific threat actor group. The malware sample then communicates with a command-and-control (C2) domain. Which relationship type best describes the link between the threat actor group and the malware sample?

An analyst is investigating a suspicious IP address. The threat intel platform shows a parent-child relationship where the IP is the parent of a domain. The relationship has low confidence. How should the analyst use this information?

Keep studying — Threat Intelligence Management