5.3 Explain the Process of Indicator Configuration XSOAR-ENGINEER Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC analyst wants to enrich an IP address indicator with geolocation and ASN data from an external service. What is the most appropriate way to do this?

   • ARun an enrichment playbook that queries the external service and updates the indicator's fields.
   • BCreate a new indicator type for geolocation data.
   • CUse the bulk import feature to add the geolocation data.
   • DManually look up the geolocation and ASN and type them into the indicator's comments.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team wants to prioritize alerts based on the reputation of the involved indicators. They have a mix of indicators with different reputation sources. Some indicators have conflicting reputation scores from different feeds. What is the best way to handle this?

   • AIgnore the conflicting scores and use the most recent one.
   • BConfigure a reputation aggregation policy that determines the final score based on a defined rule (e.g., highest score wins).
   • CUse the source field to determine which reputation to trust.
   • DManually review each conflicting indicator and set the reputation manually.
   Reveal Solution Discussion Select an answer first
4. 33foundation · medium

   What does an indicator's reputation score represent in XSOAR?

   • AThe date the indicator was first created
   • BThe level of trust or maliciousness associated with the indicator
   • CThe number of times the indicator has been seen in incidents
   • DThe source integration that provided the indicator
   Reveal Solution Discussion Select an answer first
5. 34foundation · medium

   Which XSOAR feature allows you to share indicators with external systems?

   • APlaybook execution
   • BExport to STIX/TAXII
   • CIncident creation
   • DDashboard creation
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A threat intelligence team wants to quickly identify indicators related to a specific phishing campaign. They have already added indicators from various sources. What is the most efficient way to group these indicators?

   • ASet the source field to 'Phishing-Campaign-X' for all related indicators.
   • BCreate a new indicator field called 'Campaign' and populate it manually.
   • CApply a custom tag named 'Phishing-Campaign-X' to all related indicators.
   • DChange the indicator type to 'Phishing' for all related indicators.
   Reveal Solution Discussion Select an answer first