5.6 Explain Threat Intel Sharing with External Security Services XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security operations center (SOC) wants to consume multiple external threat intel feeds to enrich incidents. The feeds are in different formats: STIX 2.1, OpenIOC, and CSV. The SOC uses XSOAR and wants to minimize manual effort. What should they do?

   • AManually convert each feed to a common format before importing.
   • BUse a third-party tool to convert all feeds to CSV.
   • CUse only the STIX 2.1 feed and ignore the others.
   • DUse XSOAR's feed integrations and custom parsers to normalize all feeds into a common format.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A small security team wants to improve their threat detection by leveraging external threat intelligence. They use XSOAR and want to consume external threat intel feeds to enrich their incidents. What is the primary benefit of this approach?

   • AIt automatically blocks all malicious traffic without analyst intervention.
   • BIt guarantees that all threats will be detected.
   • CIt eliminates the need for any internal threat intelligence.
   • DIt provides additional context about indicators, helping analysts prioritize and respond faster.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of an API used in threat intel sharing?

   • ATo store threat intel in a relational database
   • BTo allow automated programmatic exchange of threat intel data
   • CTo encrypt all threat intel data at rest
   • DTo provide a user interface for manual data entry
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A global company wants to share threat intel with an external security service. The company must comply with data residency laws that require data to remain within a specific country. The external service has data centers in multiple countries. What should the company do?

   • AShare data with any data center and rely on encryption.
   • BConfigure the external service to use a data center in the required country.
   • CObtain legal advice to determine if sharing is allowed.
   • DUse a VPN to route data through the required country.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization uses XSOAR and wants to share indicators with a third-party threat intel platform that supports both STIX/TAXII and a proprietary REST API. The team wants to minimize development effort. Which approach should they take?

   • ADevelop a custom integration from scratch to use the proprietary REST API.
   • BManually upload indicators to the third-party platform's web interface.
   • CUse email to share indicators with the third-party platform.
   • DUse XSOAR's built-in STIX/TAXII integration to share indicators.
   Reveal Solution Discussion Select an answer first