5.4 Explain Indicator Relationships XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–18

1. 16foundation · easy

   In XSOAR, an indicator relationship is defined as 'malware A -> C2 domain B'. What does the directionality of this relationship indicate?

   • AMalware A and C2 domain B are peers with no directional flow
   • BThe relationship is bidirectional, with both indicators acting as source and target
   • CC2 domain B is the source and malware A is the target of the relationship
   • DMalware A is the source and C2 domain B is the target of the relationship
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An indicator relationship is supported by multiple independent threat intelligence feeds, sandbox analysis results, and a confirmed incident response investigation. How should this relationship be assessed?

   • ALow strength and low confidence because relationships are always uncertain
   • BHigh strength but low confidence because the sources may be biased
   • CLow strength but high confidence because the relationship is well-known
   • DHigh strength and high confidence due to corroborating evidence from multiple sources
   Reveal Solution Discussion Select an answer first
3. 18foundation · easy

   A relationship between two indicators is based on a single unverified blog post from an unknown source. How should an analyst assess the strength and confidence of this relationship?

   • ALow strength but high confidence because the relationship is plausible
   • BHigh strength and high confidence because any relationship is better than none
   • CHigh strength but low confidence because the relationship type is clear
   • DLow strength and low confidence because the evidence is weak and unverified
   Reveal Solution Discussion Select an answer first