5.6 Explain Threat Intel Sharing with External Security Services XSOAR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team wants to improve their threat detection by sharing and consuming threat intel with an external security service. The team is concerned about the quality of the external intel and wants to ensure that only relevant and reliable indicators are used. What should they do?

   • AConsume all indicators from the external service without filtering.
   • BShare all internal indicators with the external service to build trust.
   • CImplement a scoring or validation process to filter indicators based on reliability and relevance.
   • DUse a firewall to block indicators from the external service.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which outcome is a direct benefit of sharing threat intelligence with external security services?

   • AReduced dependence on internal security tools
   • BGuaranteed protection against zero-day exploits
   • CImproved detection of threats that are new to the organization
   • DElimination of false positives in security alerts
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company uses XSOAR and wants to share threat intel with an external security service that requires real-time updates. The service supports both TAXII 2.0 and a webhook API. The company's network has strict firewall rules that may block outbound connections. What should the company do to ensure reliable sharing?

   • AUse a VPN to bypass the firewall restrictions.
   • BUse TAXII 2.0, as it is the standard protocol for threat intel sharing.
   • CUse the webhook API, as it may use HTTPS on port 443, which is likely allowed.
   • DUse email to share updates, as it is always allowed.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company wants to share threat intel with an external security service that only supports TAXII 1.x. The company's XSOAR instance uses TAXII 2.0 for other integrations. What should the company do?

   • AShare indicators via email as a workaround.
   • BUpgrade the external service to support TAXII 2.0.
   • CUse STIX 2.0 format with the TAXII 1.x service.
   • DConfigure a separate TAXII 1.x integration in XSOAR for this external service.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How are threat intel feeds typically consumed by external security services?

   • ABy importing the feed data into their detection and prevention mechanisms
   • BBy storing the feed data in a data lake for future analysis
   • CBy converting the feed data into a PDF report for management
   • DBy manually reviewing the feed data in a spreadsheet
   Reveal Solution Discussion Select an answer first