5.6 Explain Threat Intel Sharing with External Security Services XSOAR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization uses XSOAR to share threat intelligence with a partner's security platform. The partner's platform only supports TAXII 2.0. Which XSOAR action would enable this sharing?

   • AUse a STIX 1.x integration to share indicators, as it is compatible with TAXII 2.0.
   • BConfigure a TAXII 2.0 feed integration in XSOAR to push indicators to the partner's TAXII server.
   • CUse an email integration to send indicators in a JSON attachment.
   • DExport indicators as a PDF report and send it to the partner.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How do playbooks automate threat intel sharing in XSOAR?

   • ABy requiring an analyst to manually run each step
   • BBy replacing the need for external services
   • CBy executing a series of predefined actions, such as sending indicators to an external service
   • DBy storing threat intel in a local database only
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational company wants to share threat intel with an external security service. The company must comply with GDPR and ensure that personal data is not shared. What should the company do before sharing?

   • AShare all data as-is to provide maximum value to the external service.
   • BUse a VPN to encrypt the data during transfer.
   • CSanitize the threat intel data to remove any personal data before sharing.
   • DObtain consent from all individuals whose data might be included.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is data normalization important when sharing threat intel with external services?

   • AIt ensures that the data is in a consistent format that can be understood by the receiving system.
   • BIt makes the data readable by humans.
   • CIt increases the size of the data to ensure completeness.
   • DIt removes all sensitive information from the data.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a common type of threat intel feed?

   • AIP address reputation feed
   • BNetwork bandwidth usage feed
   • CUser login history feed
   • DCPU performance feed
   Reveal Solution Discussion Select an answer first