5.3 Explain the Process of Indicator Configuration XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   What is the primary purpose of tagging indicators in XSOAR?

   • ATo automatically delete indicators
   • BTo organize and filter indicators for easier management
   • CTo set the expiration date
   • DTo change the indicator's reputation score
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An analyst is merging two indicators that have different tags and sources. They want to preserve all the context from both indicators. What is the best practice?

   • AKeep both indicators and use a tag to link them.
   • BDelete both indicators and create a new one with all the tags and sources.
   • CUse the merge feature and ensure that tags and sources from both indicators are combined.
   • DManually copy the tags and sources from one indicator to the other and then delete the duplicate.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A threat intelligence team wants to ensure that indicators from a specific source are automatically tagged as 'high-priority' and 'do-not-expire'. They have an integration that ingests these indicators. What is the most efficient way to achieve this?

   • AUse the bulk import feature to re-import the indicators with tags.
   • BCreate a playbook that runs after ingestion and applies the tags to indicators from that source.
   • CConfigure the integration's indicator ingestion settings to apply the tags automatically.
   • DManually tag each indicator after ingestion.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team wants to ensure that indicators with a 'malicious' reputation automatically block traffic on their firewall. They have an integration with the firewall. What is the most effective way to achieve this?

   • ASet the indicator expiration date to trigger the firewall block.
   • BCreate a playbook that triggers on indicator reputation changes and pushes the indicator to the firewall.
   • CManually export malicious indicators and upload them to the firewall daily.
   • DConfigure the firewall integration to automatically pull all indicators from XSOAR.
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   What is the main benefit of merging duplicate indicators in XSOAR?

   • AIt increases the reputation score of the indicator
   • BIt extends the expiration date automatically
   • CIt creates a new indicator type
   • DIt consolidates threat intelligence and reduces clutter
   Reveal Solution Discussion Select an answer first