5.4 Explain Indicator Relationships XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A threat intel platform shows a relationship between a domain and an IP address. The relationship is marked as 'peer' with high confidence. However, the analyst knows that the domain is a legitimate website and the IP is a known malicious C2 server. How should the analyst reconcile this discrepancy?

   • AReject the relationship because the domain is legitimate
   • BReview the underlying evidence for the relationship before making a decision
   • CAccept the relationship as high confidence because the platform is authoritative
   • DIgnore the relationship because it conflicts with known information
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   In a relationship graph, a domain node has two outgoing edges labeled 'resolves to' pointing to two different IP addresses. What does this graph indicate?

   • AThe domain is a peer of both IP addresses
   • BThe IP addresses are derived from the domain
   • CThe domain has resolved to both IP addresses, possibly at different times
   • DThe domain is a parent of both IP addresses
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During an incident, an analyst identifies a malicious document hash. Further investigation reveals that the document was delivered via a phishing email, and the email originated from a C2 server. The C2 server also communicates with a second malware family. Which relationship type best describes the link between the document hash and the C2 server?

   • APeer relationship
   • BDerived relationship
   • CSource-target relationship
   • DParent-child relationship
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A threat intel platform shows a relationship between a domain and an IP address. The relationship is based on three independent passive DNS sources that all observed the same resolution within the last 24 hours. What is the most appropriate confidence level for this relationship?

   • AMedium confidence, because the relationship is recent but not confirmed by active resolution
   • BHigh confidence, because multiple independent sources corroborate the relationship
   • CNo confidence, because passive DNS data is always outdated
   • DLow confidence, because passive DNS is not a reliable source
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   In a threat intelligence graph, a file hash has an edge pointing to a domain with the label 'downloaded from'. The domain has an edge pointing to an IP address with the label 'resolves to'. What is the correct interpretation of the directionality?

   • AThe IP is the source for the domain, and the domain is the source for the file hash
   • BThe domain is the source for both the file hash and the IP
   • CThe file hash is the source, the domain is the target, and the domain is the source for the IP
   • DAll three indicators are peers with no directionality
   Reveal Solution Discussion Select an answer first