5.1 Identify and Describe Threat Intelligence Features XSOAR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following best describes how XSOAR manages the lifecycle of threat intelligence indicators?

   • AIndicators are stored with metadata such as source, confidence, and expiration date
   • BIndicators are stored only if they are manually entered by an analyst
   • CIndicators are automatically deleted after they are used in an incident
   • DIndicators are only stored in memory and lost on system restart
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does XSOAR integrate with external threat intelligence platforms?

   • ABy manually copying data from external platforms into XSOAR
   • BBy using a VPN to access external platforms' databases directly
   • CBy installing external platforms as plugins inside XSOAR
   • DThrough integrations that use APIs to connect to external services
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An XSOAR administrator wants to automate the response to indicators that are scored as 'Malicious' by the threat intelligence feed. The desired action is to automatically block the indicator on the firewall and create a ticket in the ticketing system. What is the most efficient way to implement this?

   • AManually block the indicator and create a ticket each time a malicious indicator is identified
   • BConfigure the feed integration to automatically block indicators on ingestion
   • CCreate a playbook that is triggered when an indicator is created with a reputation of 'Malicious' and includes tasks to block and create a ticket
   • DUse a job to periodically search for malicious indicators and then run a script to block them
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization wants to ingest threat intelligence from multiple external sources, including a commercial feed, an open-source feed, and a custom CSV file from an internal research team. They need to ensure that indicators from all sources are automatically available for enrichment and correlation. What is the most efficient way to achieve this in XSOAR?

   • AConfigure separate feed integrations for each source and enable the 'Auto-Enrich' option on each integration
   • BExport all indicators to a STIX file and import them into XSOAR as a single feed
   • CManually upload the CSV file and configure a single integration for the commercial feed, then use a script to merge all indicators
   • DUse a single generic feed integration and configure it to pull from all three sources by changing the URL in the integration settings
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst wants to quickly find all indicators that have been ingested from a specific threat intelligence feed and have a reputation score above 80. Which XSOAR feature should they use?

   • AThe Threat Intelligence Feed page, which shows all indicators from all feeds
   • BA custom report that exports all indicators to CSV
   • CThe Incidents page with a query for indicators with high reputation
   • DThe Indicators page with a search query filtering by source and score
   Reveal Solution Discussion Select an answer first