An organization wants to categorize indicators by campaign and confidence level to improve filtering and reporting. They have a mix of indicators from different sources. What is the recommended approach to achieve this?

Use the comments field to store campaign and confidence information.

Use the source field to indicate campaign and the expiration field to indicate confidence.

Create separate indicator types for each campaign and confidence level.

Apply custom tags for campaign names and use the standard reputation field to represent confidence.

Which of the following is an example of using indicator classification in XSOAR?

Setting the indicator's source to 'ThreatFeeds'

Changing the indicator type from IP to URL

Categorizing an indicator as 'malicious' or 'benign'

Assigning a playbook to the indicator

A security operations center (SOC) needs to share a curated set of malicious indicators with an external threat intelligence platform. The indicators are already in XSOAR and have been tagged with 'share-external'. What is the most efficient way to export only these indicators?

Manually copy the indicator values into a spreadsheet and send it.

Create a new indicator type for external sharing and move the indicators to it.

Use the bulk import feature to export the indicators.

Use the export functionality and filter by the 'share-external' tag.

What is the purpose of indicator enrichment in XSOAR?

To add additional context and threat intelligence from integrated sources

To delete indicators that are no longer relevant

Palo Alto NetworksCertified XSOAR Engineer

Domain 5Objective 3

5.3 Explain the Process of Indicator Configuration XSOAR-ENGINEER Practice Questions (Page 5)

Part of the Threat Intelligence Management domain, which accounts for 18% of the XSOAR-ENGINEER exam.

35questions here

7free pages

10concepts

18%of the exam

Questions 21–25

21application · medium
An organization wants to categorize indicators by campaign and confidence level to improve filtering and reporting. They have a mix of indicators from different sources. What is the recommended approach to achieve this?
Select an answer first
22foundation · medium
Which of the following is NOT a standard indicator type in XSOAR?
Select an answer first
23foundation · medium
Which of the following is an example of using indicator classification in XSOAR?
Select an answer first
24application · medium
A security operations center (SOC) needs to share a curated set of malicious indicators with an external threat intelligence platform. The indicators are already in XSOAR and have been tagged with 'share-external'. What is the most efficient way to export only these indicators?
Select an answer first
25foundation · medium
What is the purpose of indicator enrichment in XSOAR?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XSOAR-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSOAR-ENGINEER” is a trademark of its owner, used for identification only.