5.1 Identify and Describe Threat Intelligence Features XSOAR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In Cortex XSOAR, what does an indicator's reputation score represent?

   • AThe number of times the indicator has appeared in incidents
   • BThe size of the indicator in bytes
   • CThe level of trust or maliciousness associated with the indicator based on threat intelligence
   • DThe age of the indicator in the database
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst notices that a domain has a reputation score of 100, but the domain is actually a legitimate site that was incorrectly flagged by a feed. The analyst wants to correct this so that future alerts do not fire on this domain. What is the best action?

   • AChange the feed integration's reputation threshold to exclude this domain
   • BCreate a playbook that ignores this domain in all future alerts
   • CManually override the reputation score to 0 and add a comment explaining the correction
   • DDelete the indicator from XSOAR
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of an external threat intelligence service that XSOAR can integrate with?

   • AGoogle Chrome
   • BMicrosoft Word
   • CVirusTotal
   • DWindows Defender
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security operations center (SOC) uses XSOAR to enrich indicators. They have a high volume of indicators and want to enrich them with a commercial feed that has API rate limits. They also want to ensure that critical indicators (e.g., those related to active incidents) are enriched first. What is the best strategy?

   • AEnrich all indicators in a single batch, ignoring rate limits, and hope the API does not throttle
   • BManually enrich only the indicators related to active incidents
   • CDisable enrichment for all indicators and rely on the feed's built-in reputation scores
   • DUse a scheduled job to enrich indicators in batches, prioritizing indicators linked to active incidents
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses XSOAR and wants to integrate with an external threat intelligence platform (TIP) to pull indicators and also push back indicators that were confirmed as malicious during investigations. Which XSOAR feature supports this bidirectional exchange?

   • AA single feed integration that only ingests indicators from the TIP
   • BThe built-in STIX export feature, which automatically sends indicators to the TIP
   • CA custom script that manually copies indicators to the TIP via email
   • DA TIP integration that supports both ingestion and export of indicators
   Reveal Solution Discussion Select an answer first