5.6 Explain Threat Intel Sharing with External Security Services XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A financial institution uses XSOAR and wants to share threat intel with an external security service. The institution must comply with PCI DSS and cannot share cardholder data. The threat intel includes IP addresses and domains, but some incidents contain logs with potential cardholder data. What should the institution do?

   • AShare all incident data as-is to provide maximum context to the external service.
   • BUse encryption to protect the data during transfer.
   • CImplement a playbook that sanitizes incident data to remove any cardholder data before sharing.
   • DObtain written consent from all customers before sharing any data.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst wants to consume a threat intel feed that provides indicators in OpenIOC format. The analyst's XSOAR instance does not natively support OpenIOC. What should the analyst do?

   • AManually enter each indicator from the feed into XSOAR.
   • BUse a different threat intel platform that supports OpenIOC.
   • CUse a custom parser or integration to convert OpenIOC to a supported format.
   • DIgnore the feed and rely on internal intelligence only.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to automate the sharing of newly detected malicious IP addresses with an external blocklist service. The team uses XSOAR for incident management. Which approach should they use?

   • AUse a scheduled report to email the IPs to the blocklist service.
   • BManually copy the IPs from each incident and paste them into the blocklist service's web portal.
   • CCreate a playbook that triggers on incident creation and uses an integration to push the IPs to the blocklist service.
   • DConfigure a firewall rule to block the IPs directly from XSOAR.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is an example of normalizing threat intel data?

   • ACompressing the data to reduce bandwidth
   • BRemoving duplicate indicators from the feed
   • CEncrypting the data before transmission
   • DConverting all timestamps to UTC
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company wants to share threat intel with an external security service that requires indicators in STIX/TAXII format. The company's XSOAR instance currently stores indicators in a custom format. What should the company do to ensure the indicators are shared correctly?

   • AManually reformat each indicator in a text editor before sharing.
   • BShare the indicators in the custom format and let the external service convert them.
   • CUse a CSV export and email it to the external service.
   • DUse XSOAR's built-in STIX/TAXII integration to convert and share indicators in the required format.
   Reveal Solution Discussion Select an answer first