SecOps-Pro Threat Intelligence And Secops Processes — Timed 10 Questions

Question 1

A security analyst notices that XDR incidents are not being updated with threat intelligence data from AutoFocus. Which menu path should the analyst check to verify the AutoFocus integration status?

Accepted Answer

Settings > Configurations > Integrations > AutoFocus. The integration status is found within the Settings menu under Integrations.

Answer

Incidents > Threat Intel > AutoFocus Status

Answer

Policies > Security Profiles > AutoFocus

Answer

Marketplace > Installed Integrations > AutoFocus

Question 2

You are managing IOCs in Cortex XSOAR and need to ensure that expired indicators are purged from the system after 30 days. Where do you configure this retention policy?

Accepted Answer

Settings > Indicators > Indicator Settings. In Cortex XSOAR, indicator retention and expiration policies are configured under Settings > Indicators > Indicator Settings. This section allows you to define how long indicators are retained and when they are purged, including the 30-day retention policy for expired indicators.

Answer

Settings > Server Configuration > Retention

Answer

Playbooks > Indicator Management > Cleanup

Answer

Jobs > Cleanup Tasks

Question 3

You are integrating Cortex XSOAR with a third-party threat intelligence platform. Which configuration setting is required to ensure that incoming indicators are automatically mapped to the appropriate threat intelligence source in the Indicator Lifecycle management?

Accepted Answer

Set the integration instance to 'Active' with 'Auto-map' enabled. Mapping is handled through the indicator type and source mapping configurations in the integration settings.

Answer

Set the indicator severity to 'High' in the integration instance

Answer

Create a new threat intel feed via the API

Answer

Configure a custom playbook to trigger on indicator import

Question 4

You want to limit the visibility of certain sensitive threat intelligence indicators to only senior analysts. How is this achieved in XSOAR?

Accepted Answer

By assigning specific Roles with RBAC to the indicators. Roles and permissions in XSOAR allow granular control over data access.

Answer

By deleting the indicators

Answer

By encrypting the database

Answer

By moving indicators to a separate server

Question 5

When integrating Palo Alto Networks AutoFocus into XSOAR, which specific field allows you to map AutoFocus 'Tags' to XSOAR 'Labels'?

Accepted Answer

Mapping Fields. The mapping configuration in the integration instance settings allows for custom field and label mapping.

Answer

Feed Fetch Settings

Answer

Advanced Options

Answer

Indicator Thresholds

Question 6

How can an administrator ensure that only verified, high-confidence IOCs trigger automatic blocking actions on a Palo Alto Networks Firewall?

Accepted Answer

Configure an indicator threshold in the Blocking Playbook. Reputation scoring and thresholds are used to filter indicators before action.

Answer

Delete all low-confidence feeds

Answer

Disable automatic ingestion

Answer

Set the integration to 'Manual' mode

Question 7

When defining a custom indicator type in XSOAR, which field is mandatory to ensure it can be tracked in the Threat Intel module?

Accepted Answer

Indicator Type Name. All indicators must have a reputation score or type associated to be processed by the threat intelligence engine.

Answer

Default Expiration

Answer

Source Mapping

Answer

Default Color

Question 8

You have a custom threat intelligence source that provides data in CSV format. How can you ingest this into XSOAR?

Accepted Answer

Use the Generic Feed integration. XSOAR supports CSV ingestion through the generic Feed integration.

Answer

Write a Python script to copy the file

Answer

Use the API to upload to the database

Answer

Create an incident manually

Question 9

Which tool in the XSOAR suite is best suited for documenting the steps taken during an incident to ensure repeatable processes?

Accepted Answer

Playbook. Playbooks are specifically designed for documenting and automating incident response procedures.

Answer

Dashboard

Answer

Reporter

Answer

War Room

Question 10

Which component in XSOAR allows you to test a playbook in a controlled environment before deploying it?

Accepted Answer

Playbook Debugger. The 'Playbook Debugger' or 'Sandbox' environment allows for testing.

Answer

Production Server

Answer

Dashboard

Answer

Integration Settings