5.1 Identify and Describe Threat Intelligence Features XSOAR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary benefit of automating threat intelligence features in XSOAR?

   • AIt guarantees that all threats are blocked automatically
   • BIt eliminates the need for any human oversight
   • CIt reduces manual effort and speeds up response times
   • DIt increases the number of false positives
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An XSOAR administrator is troubleshooting why some indicators are not appearing in the Indicators page even though the feed integration reports successful ingestion. The indicators are from a feed that uses a custom parser. What is the most likely cause?

   • AThe custom parser is not correctly mapping the indicator type or value, causing the indicators to be rejected
   • BThe feed integration is configured to skip indicators with a reputation of 'Unknown'
   • CThe indicators are being ingested but are immediately deleted by a cleanup job
   • DThe indicators are being ingested as incidents instead of indicators
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of importing indicators into XSOAR?

   • ATo create new playbooks automatically
   • BTo update the XSOAR software version
   • CTo remove outdated indicators from the database
   • DTo bring external threat intelligence into the platform for use in detection and response
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of a threat intelligence feed type that XSOAR can ingest?

   • AA CSV file containing a list of malicious IP addresses
   • BA log file from a firewall showing traffic patterns
   • CA YAML file defining a playbook's automation steps
   • DA JSON file containing user access policies
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization has a playbook that creates an incident when an indicator with a reputation of 'Suspicious' is seen in logs. They want to reduce false positives by only creating incidents for indicators that have been enriched by at least two different threat intelligence sources. What is the best way to implement this?

   • ADisable the playbook and rely on manual review of all suspicious indicators
   • BChange the reputation threshold to 'Malicious' so only malicious indicators create incidents
   • CModify the playbook to check the number of enrichment sources for the indicator before creating an incident
   • DConfigure the feed integration to only ingest indicators that have been enriched by two sources
   Reveal Solution Discussion Select an answer first