XSOAR-Engineer Threat Intelligence Management — All Questions With Answers

Question 1mediummultiple choice

Read the full Threat Intelligence Management explanation →

A security analyst notices that indicators fetched from a specific OSINT feed are overriding higher-confidence internal indicators. Where should the administrator configure indicator scoring rules to resolve this?

Question 2mediummultiple choice

Read the full Threat Intelligence Management explanation →

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

Question 3mediummultiple choice

Read the full Threat Intelligence Management explanation →

An organization wants to expire indicators automatically if they have not been seen in any incoming feeds for 90 days. Where is this expiration threshold configured?

Question 4mediummultiple choice

Read the full Threat Intelligence Management explanation →

An analyst wants to bulk update the tags of 500 indicators selected from a Threat Intel query result. Which feature should be used?

Question 5easymultiple choice

Read the full Threat Intelligence Management explanation →

Where can an administrator view the status and execution logs of scheduled threat feed fetches in Cortex XSOAR?

Question 6hardmultiple choice

Read the full Threat Intelligence Management explanation →

An enterprise requires that all threat indicators ingested from external feeds be automatically enriched via VirusTotal before being marked as active. Where should this workflow logic be configured?

Question 7hardmultiple choice

Read the full Threat Intelligence Management explanation →

An enterprise uses Cortex XSOAR to synchronize indicators to multiple firewall enforcement points. A feed pushes indicators with a custom attribute. How can the administrator ensure this custom attribute is included in the exported TAXII/STIX bundle?

Question 8mediummultiple choice

Read the full Threat Intelligence Management explanation →

An administrator wants to ensure that threat indicators received from a low-reputation feed do not automatically alter overall incident severities. Where is indicator-to-incident impact configured?

Question 9easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst needs to quickly check whether an MD5 file hash exists across all active threat intel feeds without navigating through multiple menus. Where can this be performed?

Question 10mediummultiple choice

Read the full Threat Intelligence Management explanation →

An analyst wants to generate a report summarizing all critical indicators ingested over the past week tagged with 'APT29'. Where can this report be created and scheduled?

Question 11hardmultiple choice

Read the full Threat Intelligence Management explanation →

A custom threat intelligence feed integration is returning timeout errors during large data fetches. Which integration parameter should the administrator adjust to handle large payloads?

Question 12hardmultiple choice

Study the full Python automation breakdown →

When writing a custom Python integration for a threat feed, which Demisto/XSOAR command is used to ingest fetched indicators into the platform database?

Question 13easymulti select

Read the full Threat Intelligence Management explanation →

Which TWO attributes are mandatory when defining a custom indicator type in Cortex XSOAR? Choose 2 answers.

Question 14mediummultiple choice

Read the full Threat Intelligence Management explanation →

A threat intel engineer is troubleshooting a custom feed integration in Cortex XSOAR. Indicators fetched from the feed are visible in the war room under the fetch command results, but they never appear on the Threat Intel page. The integration's fetch-indicators command returns a list of indicator objects. Which configuration step is most likely missing?

Question 15hardmultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is configuring a new feed integration that ingests indicators from a commercial vendor. The vendor's API returns a 'confidence' integer from 0 to 100 for each indicator, and the security team wants indicators with confidence below 40 to be ingested but automatically given a Benign reputation instead of Suspicious or Bad. Which configuration approach in the feed integration instance settings accomplishes this requirement with the least custom code?

Question 16mediummultiple choice

Read the full Threat Intelligence Management explanation →

A threat intelligence analyst at a SOC notices that a specific IP address (203.0.113.45) is being reported by an internal honeypot feed as 'benign' because the honeypot only logs connections, not malicious behavior. However, an external premium feed reports the same IP as 'malicious' with high confidence. The analyst wants Cortex XSOAR to automatically resolve this conflict by prioritizing the external feed's reputation over the internal honeypot feed. What should the analyst configure to achieve this?

Question 17mediummultiple choice

Read the full Ansible explanation →

A Cortex XSOAR engineer needs to add a new reputation command so that analysts can enrich a custom 'DeviceID' indicator type from the CLI and from playbook tasks. The command should accept a list of DeviceID values and return a DBotScore for each. Which XML file must be edited to register this new command and its arguments in the integration?

Question 18easymultiple choice

Read the full Threat Intelligence Management explanation →

A security team wants Cortex XSOAR to automatically create a new incident whenever a threat feed indicator that is already in the Threat Intel database is later seen in a newly ingested indicator from a different feed, so analysts can review the overlap. Which built-in mechanism should the engineer configure to achieve this?

Question 19mediummultiple choice

Read the full Threat Intelligence Management explanation →

An engineer is configuring a new TAXII 2.1 feed integration in Cortex XSOAR and wants indicators fetched from the collection to be written directly into the Threat Intel database with the feed's own reputation applied, without any manual review step. Which integration parameter must be enabled to achieve this behavior?

Question 20mediummulti select

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is asked to reduce noise in the Threat Intel database. Several feed integrations are ingesting indicators that overlap with ones already present from higher-fidelity sources, and the team wants to ensure that when two feeds report the same indicator, the more trusted feed's reputation prevails. Which TWO configuration capabilities in Cortex XSOAR help control how conflicting indicator reputations from multiple feeds are resolved? (Choose two.)

Question 21easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst needs to quickly check how many indicators in the Cortex XSOAR Threat Intel database are of type IP and are currently marked as Bad. Which built-in capability provides this summary without writing a query in the indicator search bar?

Question 22easymultiple choice

Read the full Threat Intelligence Management explanation →

A junior analyst is investigating an incident and wants to quickly check the reputation of an IP address (198.51.100.22) that appears in multiple alerts. The analyst has not yet added this IP to the Threat Intel database. Which Cortex XSOAR feature allows the analyst to view the reputation and associated indicators for this IP directly from the incident War Room without leaving the incident context?

Question 23hardmultiple choice

Read the full Threat Intelligence Management explanation →

A security team ingests indicators from an internal proprietary feed and from a public OSINT feed. Analysts complain that a specific IP address repeatedly flips between 'Malicious' and 'Benign' in the Threat Intel page even though neither feed's data has changed. Which Cortex XSOAR mechanism should the engineer adjust to resolve the conflicting reputation assignments?

Question 24mediummulti select

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR administrator is designing a workflow to keep the Threat Intel database current. The team wants indicators that have not been observed in any connected feed for 90 days to be automatically removed from the database. Which TWO configuration elements are required to achieve this? (Choose two.)

Question 25easymultiple choice

Read the full Threat Intelligence Management explanation →

A security analyst in Cortex XSOAR is investigating an incident and wants to quickly see all known context about an IP address that appeared in an alert, including its reputation, associated tags, and which feeds have reported it, without leaving the incident war room. Which Cortex XSOAR action provides this consolidated indicator context directly within the incident investigation flow?

Question 26mediummultiple choice

Read the full Threat Intelligence Management explanation →

A security operations center (SOC) uses Cortex XSOAR to manage threat intelligence. They have a requirement to automatically share high-severity indicators (score >= 8) with an external partner's MISP instance every hour. Which Cortex XSOAR feature should the engineer use to export these indicators to MISP?

Question 27mediummulti select

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is building a workflow that enriches indicators from a new threat feed with relationships to related indicators already in the Threat Intel database. Which TWO capabilities of the threat intel module should the engineer rely on to associate and navigate these relationships? (Choose two.)

Question 28mediummultiple choice

Study the full Python automation breakdown →

An engineer is writing a custom Python feed integration. After fetching a batch of indicators from an external API, the engineer must push them into the Cortex XSOAR Threat Intel database from within the integration code. Which helper function should be used to create the indicators?

Question 29hardmultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is building an integration that ingests indicators from a partner's REST API. The partner API returns indicators in a custom JSON format, including fields for value, type, and a confidence score. The engineer wants the indicators to appear in the Threat Intel database with the correct type and a reputation derived from the confidence score. Which approach correctly maps the partner's data to Cortex XSOAR indicators?

Question 30mediummultiple choice

Read the full Threat Intelligence Management explanation →

A SOC uses an XSOAR indicator query to enrich incidents. The engineer needs an indicator to be excluded from future automatic enrichment lookups without deleting it from the Threat Intel database, because it is still referenced by open incidents. Which action should the engineer take on the indicator?

Question 31mediummultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is configuring a new TIM (Threat Intel Management) feed integration for a premium vendor that requires the same API token to be reused across multiple feed instances. During the first fetch, the integration returns HTTP 429 with a Retry-After header. The engineer wants the feed to back off and retry automatically without losing the last fetch timestamp. Which configuration on the feed integration instance should the engineer verify?

Question 32easymultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR analyst wants to see which of the currently ingested indicators have been observed in more than one feed, so they can prioritize high-confidence indicators. Which TIM feature should the analyst use to view indicators that appear across multiple sources?

Question 33easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst wants to view the historical reputation changes of a specific malicious IP address over time. Which tab within the Indicator Details page provides this timeline?

Question 34hardmultiple choice

Read the full Threat Intelligence Management explanation →

When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?

Question 35hardmultiple choice

Read the full Threat Intelligence Management explanation →

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

Question 36easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?

Question 37easymultiple choice

Read the full Threat Intelligence Management explanation →

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Question 38hardmultiple choice

Read the full Threat Intelligence Management explanation →

A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?

Question 39easymultiple choice

Read the full Threat Intelligence Management explanation →

When setting up a new threat intelligence feed, what parameter determines how far back in time the integration pulls historical indicators upon initial run?

Question 40mediummultiple choice

Read the full Threat Intelligence Management explanation →

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

Question 41easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

Question 42hardmultiple choice

Read the full Threat Intelligence Management explanation →

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

Question 43mediummultiple choice

Read the full Threat Intelligence Management explanation →

A scheduled feed is failing with a certificate verification error because the feed source uses an internal self-signed SSL certificate. How can an administrator resolve this in Cortex XSOAR?

Question 44easymultiple choice

Read the full Threat Intelligence Management explanation →

Which indicator type should an administrator select when configuring a feed that supplies malicious URL strings?

Question 45hardmultiple choice

Read the full Threat Intelligence Management explanation →

An organization uses a custom threat feed that updates via an API requiring OAuth2 authentication with token rotation. How should the administrator configure this integration instance?

Question 46easymultiple choice

Read the full Threat Intelligence Management explanation →

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

Question 47hardmulti select

Read the full Threat Intelligence Management explanation →

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

Question 48mediummulti select

Read the full Threat Intelligence Management explanation →

Which THREE parameters are typically required when configuring a generic REST API feed integration instance in Cortex XSOAR? Choose 3 answers.

Question 49mediummultiple choice

Read the full Threat Intelligence Management explanation →

An analyst observes that an indicator's score is fluctuating between malicious and benign because two different feeds report contradictory reputations. How can the administrator enforce that Feed A always takes precedence over Feed B?

Question 50easymultiple choice

Read the full Threat Intelligence Management explanation →

An administrator needs to temporarily disable a noisy threat intelligence feed without losing its configuration settings. What is the correct action?

Question 51easymulti select

Read the full Threat Intelligence Management explanation →

Which TWO actions can an administrator perform within the Cortex XSOAR Threat Intel workspace when managing indicators? Choose 2 answers.

Question 52hardmulti select

Read the full Threat Intelligence Management explanation →

When troubleshooting a feed integration that fails to parse incoming data, which TWO diagnostic steps should an administrator take? Choose 2 answers.

Question 53easymulti select

Read the full Threat Intelligence Management explanation →

Which TWO details are typically visible within an individual Indicator Details view in Cortex XSOAR? Choose 2 answers.

Question 54mediummulti select

Read the full Threat Intelligence Management explanation →

Which THREE configuration settings can be applied to manage indicator lifecycles in Cortex XSOAR? Choose 3 answers.

Question 55hardmulti select

Read the full Threat Intelligence Management explanation →

Which TWO advanced configurations are required when setting up a TAXII 2.0/2.1 client feed in Cortex XSOAR? Choose 2 answers.

Question 56mediummulti select

Read the full Threat Intelligence Management explanation →

Which THREE methods can be used to export threat indicators out of Cortex XSOAR to external systems? Choose 3 answers.

Question 57mediummulti select

Read the full Threat Intelligence Management explanation →

Which THREE types of data can be ingested as threat intelligence indicators in Cortex XSOAR out-of-the-box? Choose 3 answers.

Question 58easymulti select

Read the full Threat Intelligence Management explanation →

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

Question 59hardmulti select

Read the full Threat Intelligence Management explanation →

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

Question 60mediummultiple choice

Read the full Threat Intelligence Management explanation →

A threat intel analyst at a SOC is reviewing a domain indicator in Cortex XSOAR that has been assigned a score of 3 (Bad). The analyst wants to clearly understand which specific threat feed integration was responsible for assigning that malicious score, so they can evaluate whether the source is trustworthy. Where should the analyst look to determine the origin of the indicator's score in Cortex XSOAR?

Question 61mediummultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer configures a new TAXII 2.1 feed using the TAXII2 Server integration. The feed instance connects successfully, but the engineer notices that indicators already present in the Threat Intel database from other sources are not being linked to the new feed's source. Which setting on the feed instance must be reviewed to ensure existing indicators are associated with this feed's source?

Question 62hardmultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is using the built-in TAXII2 integration to pull indicators from a partner's server. The partner recently started publishing indicators with the STIX pattern type 'network-traffic' (for IP-and-port combinations), but these objects never appear on the Threat Intel page even though other indicator types from the same collection arrive normally. The feed instance shows a successful fetch with no errors. What is the most likely cause?

Question 63hardmultiple choice

Read the full Threat Intelligence Management explanation →

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

Question 64hardmultiple choice

Read the full Threat Intelligence Management explanation →

A security team notices that a domain indicator's reputation score in Cortex XSOAR keeps dropping from Bad to Suspicious, then returning to Bad, even though no analyst has manually changed it. The domain is reported by two feeds: Feed A assigns a Bad reputation, and Feed B assigns a Benign reputation. Both feeds are configured with the same expiration and both run every hour. What is the most likely cause of the fluctuating score?

Question 65hardmultiple choice

Read the full Threat Intelligence Management explanation →

A security engineer is integrating a new TAXII 2.1 feed into Cortex XSOAR. The feed requires authentication using a client certificate and a private key. After configuring the integration instance with the correct certificate and key, the engineer notices that no indicators are being fetched, and the integration logs show 'SSL certificate verification failed'. The TAXII server uses a self-signed certificate. What should the engineer do to resolve this issue while maintaining security best practices?

Question 66mediummultiple choice

Read the full Threat Intelligence Management explanation →

A security team wants to ensure that indicators ingested from a newly integrated MISP feed are automatically tagged with a specific label for easier filtering and correlation. Which configuration on the MISP feed instance in Cortex XSOAR allows the engineer to apply a custom tag to all indicators from this feed?

Question 67hardmultiple choice

Read the full Threat Intelligence Management explanation →

An engineer is building a custom indicator type for 'CryptocurrencyAddress' and wants Cortex XSOAR to automatically extract these values from incident evidence and enrich them. The engineer has created the indicator type and a reputation command. Which additional configuration is required so that the platform automatically identifies CryptocurrencyAddress values in new incidents and runs the reputation command?

Question 68mediummulti select

Read the full Threat Intelligence Management explanation →

A security team wants to share indicators from Cortex XSOAR with an external partner's TAXII 2.1 server and also push indicators to a SIEM via a supported export mechanism. Which TWO Cortex XSOAR capabilities support exporting threat indicators to external systems? (Choose two.)

Question 69hardmultiple choice

Read the full Threat Intelligence Management explanation →

An engineer is configuring indicator expiration for a threat feed. The organization wants indicators from this feed to expire 30 days after they are last seen in the feed. The engineer sets the 'Expiration' parameter to 30 days on the feed instance. However, after 30 days, indicators are still present in the Threat Intel database. Which factor is most likely preventing the expiration from occurring?

Question 70hardmultiple choice

Read the full Threat Intelligence Management explanation →

An engineer needs Cortex XSOAR to enrich every newly ingested indicator from an external feed by querying an internal WHOIS service before the indicator is stored, and to block ingestion if enrichment fails. The WHOIS service is exposed through a custom integration. Which approach best meets this requirement?

Question 71easymultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is reviewing an incident and wants to see the enrichment details for a specific IP indicator, including which integrations produced scores and when the indicator was last seen. From the incident's indicator list, which action opens the full Indicator Details view for that IP?

Question 72mediummultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer must ensure that indicators from a high-confidence internal feed are never automatically expired by threat intel management rules, even when they have not been seen for a long period. Which configuration achieves this?

Question 73hardmultiple choice

Read the full Threat Intelligence Management explanation →

An engineer configured a feed integration with the 'Indicator Reputation' parameter set to 'Bad' and 'Expiration' set to 30 days. After a week, analysts report that indicators from this feed still appear in the database long after the feed stopped returning them, and some indicators have a reputation of 'Good' from another source. Which behavior explains why the indicators persist and how reputation is determined?

Question 74easymultiple choice

Read the full Threat Intelligence Management explanation →

A junior analyst needs to look up whether a suspicious file hash has been seen in any ingested threat feeds and wants to see the associated feed sources, first-seen date, and current reputation in a single view. Where in Cortex XSOAR should the analyst navigate?

Question 75hardmulti select

Read the full Threat Intelligence Management explanation →

An engineer must design a workflow that exports Cortex XSOAR threat indicators to two external systems: a SIEM that ingests indicators via a REST API, and a partner organization that consumes indicators through a TAXII 2.1 server. Which TWO Cortex XSOAR capabilities should the engineer use to implement these outbound integrations? (Choose two.)

Question 76hardmultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer configures a TAXII 2.1 feed integration and confirms the server connection succeeds, but the Threat Intel page shows no indicators. The collection browser returns STIX 2.1 objects with type 'indicator' and 'observed-data'. The engineer then runs the fetch command manually and sees objects returned in the raw response. Which configuration element most likely prevents the indicators from being created in the Threat Intel database?

Question 77mediummultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer needs to ensure that a specific internal IP range used by the company's vulnerability scanners is never treated as malicious by any feed, even if a public feed later reports one of those IPs as bad. Which TIM mechanism should the engineer configure to guarantee this exclusion?

Question 78hardmultiple choice

Read the full Ansible explanation →

A Cortex XSOAR engineer is designing a playbook that must enrich an IP indicator with data from a premium TIM feed only when the indicator's current score is Suspicious or Bad. The playbook uses a task that queries the indicator via the TIM API. Which approach ensures the enrichment task runs only for indicators meeting the score condition?

Question 1mediummultiple choice

Read the full Threat Intelligence Management explanation →

A security analyst notices that indicators fetched from a specific OSINT feed are overriding higher-confidence internal indicators. Where should the administrator configure indicator scoring rules to resolve this?

Question 2mediummultiple choice

Read the full Threat Intelligence Management explanation →

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

Question 3mediummultiple choice

Read the full Threat Intelligence Management explanation →

An organization wants to expire indicators automatically if they have not been seen in any incoming feeds for 90 days. Where is this expiration threshold configured?

Question 4mediummultiple choice

Read the full Threat Intelligence Management explanation →

An analyst wants to bulk update the tags of 500 indicators selected from a Threat Intel query result. Which feature should be used?

Question 5easymultiple choice

Read the full Threat Intelligence Management explanation →

Where can an administrator view the status and execution logs of scheduled threat feed fetches in Cortex XSOAR?

Question 6hardmultiple choice

Read the full Threat Intelligence Management explanation →

An enterprise requires that all threat indicators ingested from external feeds be automatically enriched via VirusTotal before being marked as active. Where should this workflow logic be configured?

Question 7hardmultiple choice

Read the full Threat Intelligence Management explanation →

An enterprise uses Cortex XSOAR to synchronize indicators to multiple firewall enforcement points. A feed pushes indicators with a custom attribute. How can the administrator ensure this custom attribute is included in the exported TAXII/STIX bundle?

Question 8mediummultiple choice

Read the full Threat Intelligence Management explanation →

An administrator wants to ensure that threat indicators received from a low-reputation feed do not automatically alter overall incident severities. Where is indicator-to-incident impact configured?

Question 9easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst needs to quickly check whether an MD5 file hash exists across all active threat intel feeds without navigating through multiple menus. Where can this be performed?

Question 10mediummultiple choice

Read the full Threat Intelligence Management explanation →

An analyst wants to generate a report summarizing all critical indicators ingested over the past week tagged with 'APT29'. Where can this report be created and scheduled?

Question 11hardmultiple choice

Read the full Threat Intelligence Management explanation →

A custom threat intelligence feed integration is returning timeout errors during large data fetches. Which integration parameter should the administrator adjust to handle large payloads?

Question 12hardmultiple choice

Study the full Python automation breakdown →

When writing a custom Python integration for a threat feed, which Demisto/XSOAR command is used to ingest fetched indicators into the platform database?

Question 13easymulti select

Read the full Threat Intelligence Management explanation →

Which TWO attributes are mandatory when defining a custom indicator type in Cortex XSOAR? Choose 2 answers.

Question 14mediummultiple choice

Read the full Threat Intelligence Management explanation →

A threat intel engineer is troubleshooting a custom feed integration in Cortex XSOAR. Indicators fetched from the feed are visible in the war room under the fetch command results, but they never appear on the Threat Intel page. The integration's fetch-indicators command returns a list of indicator objects. Which configuration step is most likely missing?

Question 15hardmultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is configuring a new feed integration that ingests indicators from a commercial vendor. The vendor's API returns a 'confidence' integer from 0 to 100 for each indicator, and the security team wants indicators with confidence below 40 to be ingested but automatically given a Benign reputation instead of Suspicious or Bad. Which configuration approach in the feed integration instance settings accomplishes this requirement with the least custom code?

Question 16mediummultiple choice

Read the full Threat Intelligence Management explanation →

A threat intelligence analyst at a SOC notices that a specific IP address (203.0.113.45) is being reported by an internal honeypot feed as 'benign' because the honeypot only logs connections, not malicious behavior. However, an external premium feed reports the same IP as 'malicious' with high confidence. The analyst wants Cortex XSOAR to automatically resolve this conflict by prioritizing the external feed's reputation over the internal honeypot feed. What should the analyst configure to achieve this?

Question 17mediummultiple choice

Read the full Ansible explanation →

A Cortex XSOAR engineer needs to add a new reputation command so that analysts can enrich a custom 'DeviceID' indicator type from the CLI and from playbook tasks. The command should accept a list of DeviceID values and return a DBotScore for each. Which XML file must be edited to register this new command and its arguments in the integration?

Question 18easymultiple choice

Read the full Threat Intelligence Management explanation →

A security team wants Cortex XSOAR to automatically create a new incident whenever a threat feed indicator that is already in the Threat Intel database is later seen in a newly ingested indicator from a different feed, so analysts can review the overlap. Which built-in mechanism should the engineer configure to achieve this?

Question 19mediummultiple choice

Read the full Threat Intelligence Management explanation →

An engineer is configuring a new TAXII 2.1 feed integration in Cortex XSOAR and wants indicators fetched from the collection to be written directly into the Threat Intel database with the feed's own reputation applied, without any manual review step. Which integration parameter must be enabled to achieve this behavior?

Question 20mediummulti select

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is asked to reduce noise in the Threat Intel database. Several feed integrations are ingesting indicators that overlap with ones already present from higher-fidelity sources, and the team wants to ensure that when two feeds report the same indicator, the more trusted feed's reputation prevails. Which TWO configuration capabilities in Cortex XSOAR help control how conflicting indicator reputations from multiple feeds are resolved? (Choose two.)

Question 21easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst needs to quickly check how many indicators in the Cortex XSOAR Threat Intel database are of type IP and are currently marked as Bad. Which built-in capability provides this summary without writing a query in the indicator search bar?

Question 22easymultiple choice

Read the full Threat Intelligence Management explanation →

A junior analyst is investigating an incident and wants to quickly check the reputation of an IP address (198.51.100.22) that appears in multiple alerts. The analyst has not yet added this IP to the Threat Intel database. Which Cortex XSOAR feature allows the analyst to view the reputation and associated indicators for this IP directly from the incident War Room without leaving the incident context?

Question 23hardmultiple choice

Read the full Threat Intelligence Management explanation →

A security team ingests indicators from an internal proprietary feed and from a public OSINT feed. Analysts complain that a specific IP address repeatedly flips between 'Malicious' and 'Benign' in the Threat Intel page even though neither feed's data has changed. Which Cortex XSOAR mechanism should the engineer adjust to resolve the conflicting reputation assignments?

Question 24mediummulti select

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR administrator is designing a workflow to keep the Threat Intel database current. The team wants indicators that have not been observed in any connected feed for 90 days to be automatically removed from the database. Which TWO configuration elements are required to achieve this? (Choose two.)

Question 25easymultiple choice

Read the full Threat Intelligence Management explanation →

A security analyst in Cortex XSOAR is investigating an incident and wants to quickly see all known context about an IP address that appeared in an alert, including its reputation, associated tags, and which feeds have reported it, without leaving the incident war room. Which Cortex XSOAR action provides this consolidated indicator context directly within the incident investigation flow?

Question 26mediummultiple choice

Read the full Threat Intelligence Management explanation →

A security operations center (SOC) uses Cortex XSOAR to manage threat intelligence. They have a requirement to automatically share high-severity indicators (score >= 8) with an external partner's MISP instance every hour. Which Cortex XSOAR feature should the engineer use to export these indicators to MISP?

Question 27mediummulti select

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is building a workflow that enriches indicators from a new threat feed with relationships to related indicators already in the Threat Intel database. Which TWO capabilities of the threat intel module should the engineer rely on to associate and navigate these relationships? (Choose two.)

Question 28mediummultiple choice

Study the full Python automation breakdown →

An engineer is writing a custom Python feed integration. After fetching a batch of indicators from an external API, the engineer must push them into the Cortex XSOAR Threat Intel database from within the integration code. Which helper function should be used to create the indicators?

Question 29hardmultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is building an integration that ingests indicators from a partner's REST API. The partner API returns indicators in a custom JSON format, including fields for value, type, and a confidence score. The engineer wants the indicators to appear in the Threat Intel database with the correct type and a reputation derived from the confidence score. Which approach correctly maps the partner's data to Cortex XSOAR indicators?

Question 30mediummultiple choice

Read the full Threat Intelligence Management explanation →

A SOC uses an XSOAR indicator query to enrich incidents. The engineer needs an indicator to be excluded from future automatic enrichment lookups without deleting it from the Threat Intel database, because it is still referenced by open incidents. Which action should the engineer take on the indicator?

Question 31mediummultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is configuring a new TIM (Threat Intel Management) feed integration for a premium vendor that requires the same API token to be reused across multiple feed instances. During the first fetch, the integration returns HTTP 429 with a Retry-After header. The engineer wants the feed to back off and retry automatically without losing the last fetch timestamp. Which configuration on the feed integration instance should the engineer verify?

Question 32easymultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR analyst wants to see which of the currently ingested indicators have been observed in more than one feed, so they can prioritize high-confidence indicators. Which TIM feature should the analyst use to view indicators that appear across multiple sources?

Question 33easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst wants to view the historical reputation changes of a specific malicious IP address over time. Which tab within the Indicator Details page provides this timeline?

Question 34hardmultiple choice

Read the full Threat Intelligence Management explanation →

When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?

Question 35hardmultiple choice

Read the full Threat Intelligence Management explanation →

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

Question 36easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?

Question 37easymultiple choice

Read the full Threat Intelligence Management explanation →

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Question 38hardmultiple choice

Read the full Threat Intelligence Management explanation →

A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?

Question 39easymultiple choice

Read the full Threat Intelligence Management explanation →

When setting up a new threat intelligence feed, what parameter determines how far back in time the integration pulls historical indicators upon initial run?

Question 40mediummultiple choice

Read the full Threat Intelligence Management explanation →

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

Question 41easymultiple choice

Read the full Threat Intelligence Management explanation →

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

Question 42hardmultiple choice

Read the full Threat Intelligence Management explanation →

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

Question 43mediummultiple choice

Read the full Threat Intelligence Management explanation →

A scheduled feed is failing with a certificate verification error because the feed source uses an internal self-signed SSL certificate. How can an administrator resolve this in Cortex XSOAR?

Question 44easymultiple choice

Read the full Threat Intelligence Management explanation →

Which indicator type should an administrator select when configuring a feed that supplies malicious URL strings?

Question 45hardmultiple choice

Read the full Threat Intelligence Management explanation →

An organization uses a custom threat feed that updates via an API requiring OAuth2 authentication with token rotation. How should the administrator configure this integration instance?

Question 46easymultiple choice

Read the full Threat Intelligence Management explanation →

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

Question 47hardmulti select

Read the full Threat Intelligence Management explanation →

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

Question 48mediummulti select

Read the full Threat Intelligence Management explanation →

Which THREE parameters are typically required when configuring a generic REST API feed integration instance in Cortex XSOAR? Choose 3 answers.

Question 49mediummultiple choice

Read the full Threat Intelligence Management explanation →

An analyst observes that an indicator's score is fluctuating between malicious and benign because two different feeds report contradictory reputations. How can the administrator enforce that Feed A always takes precedence over Feed B?

Question 50easymultiple choice

Read the full Threat Intelligence Management explanation →

An administrator needs to temporarily disable a noisy threat intelligence feed without losing its configuration settings. What is the correct action?

Question 51easymulti select

Read the full Threat Intelligence Management explanation →

Which TWO actions can an administrator perform within the Cortex XSOAR Threat Intel workspace when managing indicators? Choose 2 answers.

Question 52hardmulti select

Read the full Threat Intelligence Management explanation →

When troubleshooting a feed integration that fails to parse incoming data, which TWO diagnostic steps should an administrator take? Choose 2 answers.

Question 53easymulti select

Read the full Threat Intelligence Management explanation →

Which TWO details are typically visible within an individual Indicator Details view in Cortex XSOAR? Choose 2 answers.

Question 54mediummulti select

Read the full Threat Intelligence Management explanation →

Which THREE configuration settings can be applied to manage indicator lifecycles in Cortex XSOAR? Choose 3 answers.

Question 55hardmulti select

Read the full Threat Intelligence Management explanation →

Which TWO advanced configurations are required when setting up a TAXII 2.0/2.1 client feed in Cortex XSOAR? Choose 2 answers.

Question 56mediummulti select

Read the full Threat Intelligence Management explanation →

Which THREE methods can be used to export threat indicators out of Cortex XSOAR to external systems? Choose 3 answers.

Question 57mediummulti select

Read the full Threat Intelligence Management explanation →

Which THREE types of data can be ingested as threat intelligence indicators in Cortex XSOAR out-of-the-box? Choose 3 answers.

Question 58easymulti select

Read the full Threat Intelligence Management explanation →

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

Question 59hardmulti select

Read the full Threat Intelligence Management explanation →

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

Question 60mediummultiple choice

Read the full Threat Intelligence Management explanation →

A threat intel analyst at a SOC is reviewing a domain indicator in Cortex XSOAR that has been assigned a score of 3 (Bad). The analyst wants to clearly understand which specific threat feed integration was responsible for assigning that malicious score, so they can evaluate whether the source is trustworthy. Where should the analyst look to determine the origin of the indicator's score in Cortex XSOAR?

Question 61mediummultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer configures a new TAXII 2.1 feed using the TAXII2 Server integration. The feed instance connects successfully, but the engineer notices that indicators already present in the Threat Intel database from other sources are not being linked to the new feed's source. Which setting on the feed instance must be reviewed to ensure existing indicators are associated with this feed's source?

Question 62hardmultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is using the built-in TAXII2 integration to pull indicators from a partner's server. The partner recently started publishing indicators with the STIX pattern type 'network-traffic' (for IP-and-port combinations), but these objects never appear on the Threat Intel page even though other indicator types from the same collection arrive normally. The feed instance shows a successful fetch with no errors. What is the most likely cause?

Question 63hardmultiple choice

Read the full Threat Intelligence Management explanation →

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

Question 64hardmultiple choice

Read the full Threat Intelligence Management explanation →

A security team notices that a domain indicator's reputation score in Cortex XSOAR keeps dropping from Bad to Suspicious, then returning to Bad, even though no analyst has manually changed it. The domain is reported by two feeds: Feed A assigns a Bad reputation, and Feed B assigns a Benign reputation. Both feeds are configured with the same expiration and both run every hour. What is the most likely cause of the fluctuating score?

Question 65hardmultiple choice

Read the full Threat Intelligence Management explanation →

A security engineer is integrating a new TAXII 2.1 feed into Cortex XSOAR. The feed requires authentication using a client certificate and a private key. After configuring the integration instance with the correct certificate and key, the engineer notices that no indicators are being fetched, and the integration logs show 'SSL certificate verification failed'. The TAXII server uses a self-signed certificate. What should the engineer do to resolve this issue while maintaining security best practices?

Question 66mediummultiple choice

Read the full Threat Intelligence Management explanation →

A security team wants to ensure that indicators ingested from a newly integrated MISP feed are automatically tagged with a specific label for easier filtering and correlation. Which configuration on the MISP feed instance in Cortex XSOAR allows the engineer to apply a custom tag to all indicators from this feed?

Question 67hardmultiple choice

Read the full Threat Intelligence Management explanation →

An engineer is building a custom indicator type for 'CryptocurrencyAddress' and wants Cortex XSOAR to automatically extract these values from incident evidence and enrich them. The engineer has created the indicator type and a reputation command. Which additional configuration is required so that the platform automatically identifies CryptocurrencyAddress values in new incidents and runs the reputation command?

Question 68mediummulti select

Read the full Threat Intelligence Management explanation →

A security team wants to share indicators from Cortex XSOAR with an external partner's TAXII 2.1 server and also push indicators to a SIEM via a supported export mechanism. Which TWO Cortex XSOAR capabilities support exporting threat indicators to external systems? (Choose two.)

Question 69hardmultiple choice

Read the full Threat Intelligence Management explanation →

An engineer is configuring indicator expiration for a threat feed. The organization wants indicators from this feed to expire 30 days after they are last seen in the feed. The engineer sets the 'Expiration' parameter to 30 days on the feed instance. However, after 30 days, indicators are still present in the Threat Intel database. Which factor is most likely preventing the expiration from occurring?

Question 70hardmultiple choice

Read the full Threat Intelligence Management explanation →

An engineer needs Cortex XSOAR to enrich every newly ingested indicator from an external feed by querying an internal WHOIS service before the indicator is stored, and to block ingestion if enrichment fails. The WHOIS service is exposed through a custom integration. Which approach best meets this requirement?

Question 71easymultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer is reviewing an incident and wants to see the enrichment details for a specific IP indicator, including which integrations produced scores and when the indicator was last seen. From the incident's indicator list, which action opens the full Indicator Details view for that IP?

Question 72mediummultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer must ensure that indicators from a high-confidence internal feed are never automatically expired by threat intel management rules, even when they have not been seen for a long period. Which configuration achieves this?

Question 73hardmultiple choice

Read the full Threat Intelligence Management explanation →

An engineer configured a feed integration with the 'Indicator Reputation' parameter set to 'Bad' and 'Expiration' set to 30 days. After a week, analysts report that indicators from this feed still appear in the database long after the feed stopped returning them, and some indicators have a reputation of 'Good' from another source. Which behavior explains why the indicators persist and how reputation is determined?

Question 74easymultiple choice

Read the full Threat Intelligence Management explanation →

A junior analyst needs to look up whether a suspicious file hash has been seen in any ingested threat feeds and wants to see the associated feed sources, first-seen date, and current reputation in a single view. Where in Cortex XSOAR should the analyst navigate?

Question 75hardmulti select

Read the full Threat Intelligence Management explanation →

An engineer must design a workflow that exports Cortex XSOAR threat indicators to two external systems: a SIEM that ingests indicators via a REST API, and a partner organization that consumes indicators through a TAXII 2.1 server. Which TWO Cortex XSOAR capabilities should the engineer use to implement these outbound integrations? (Choose two.)

Question 76hardmultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer configures a TAXII 2.1 feed integration and confirms the server connection succeeds, but the Threat Intel page shows no indicators. The collection browser returns STIX 2.1 objects with type 'indicator' and 'observed-data'. The engineer then runs the fetch command manually and sees objects returned in the raw response. Which configuration element most likely prevents the indicators from being created in the Threat Intel database?

Question 77mediummultiple choice

Read the full Threat Intelligence Management explanation →

A Cortex XSOAR engineer needs to ensure that a specific internal IP range used by the company's vulnerability scanners is never treated as malicious by any feed, even if a public feed later reports one of those IPs as bad. Which TIM mechanism should the engineer configure to guarantee this exclusion?

Question 78hardmultiple choice

Read the full Ansible explanation →

A Cortex XSOAR engineer is designing a playbook that must enrich an IP indicator with data from a premium TIM feed only when the indicator's current score is Suspicious or Bad. The playbook uses a task that queries the indicator via the TIM API. Which approach ensures the enrichment task runs only for indicators meeting the score condition?