5.3 Explain the Process of Indicator Configuration XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · medium

   What is the purpose of exporting indicators from XSOAR?

   • ATo automatically enrich the indicators
   • BTo change the indicator type
   • CTo increase the indicator's reputation score
   • DTo use the indicators in other security tools or share with partners
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A threat intelligence team is setting up indicator management in XSOAR. They want to ensure that indicators are consistently enriched, tagged, and have appropriate expiration dates. What is the best practice to achieve this?

   • ALet each analyst decide how to handle indicators on a case-by-case basis.
   • BRely on the default XSOAR settings without customization.
   • CUse a single playbook for all indicator management tasks.
   • DCreate a standard operating procedure (SOP) that defines enrichment, tagging, and expiration policies, and enforce it through playbooks.
   Reveal Solution Discussion Select an answer first
4. 8foundation · medium

   What happens to an indicator when its expiration date is reached in XSOAR?

   • AIt is automatically deleted from the system
   • BIt is converted to a different indicator type
   • CIts reputation is reset to unknown
   • DIt is marked as expired and no longer considered active
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   How can indicator reputation scores influence automation in XSOAR?

   • AThey change the indicator type automatically
   • BThey determine the indicator's expiration date
   • CThey prevent the indicator from being exported
   • DThey can trigger different playbook paths based on the score
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team wants to enrich indicators with data from multiple sources, but they want to avoid overloading the system with too many enrichment requests. They have a large number of indicators. What is the best practice?

   • AManually enrich only the most critical indicators.
   • BUse a playbook that enriches indicators in batches and includes rate limiting.
   • CDisable enrichment for all indicators to avoid overloading.
   • DEnrich all indicators at once using a single playbook.
   Reveal Solution Discussion Select an answer first