XSOAR-Engineer Threat Intelligence Management Practice Test 2 — 15 Questions

Question 1

A threat intelligence analyst at a SOC notices that a specific IP address (203.0.113.45) is being reported by an internal honeypot feed as 'benign' because the honeypot only logs connections, not malicious behavior. However, an external premium feed reports the same IP as 'malicious' with high confidence. The analyst wants Cortex XSOAR to automatically resolve this conflict by prioritizing the external feed's reputation over the internal honeypot feed. What should the analyst configure to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the 'Feed Reliability' for the external feed as 'A - Completely Reliable' and for the honeypot feed as 'F - Not Reliable'.. Feed Reliability is the built-in mechanism in Cortex XSOAR for resolving conflicting indicator reputations. When multiple feeds report different scores, the feed with the highest reliability (A being the highest) determines the final indicator score. This ensures that more trusted sources take precedence without manual intervention. Configuring reliability is a one-time setup that persists across feed updates.

Answer

Adjust the 'Reputation' weight of the external feed in the feed's integration settings to be higher than the honeypot feed.

Answer

Create a playbook that triggers on indicator updates and uses the 'setIndicator' command to force the score to malicious.

Answer

Set the indicator's manual score to 'Malicious' in the Indicator Details page.

Question 2

A Cortex XSOAR engineer needs to add a new reputation command so that analysts can enrich a custom 'DeviceID' indicator type from the CLI and from playbook tasks. The command should accept a list of DeviceID values and return a DBotScore for each. Which XML file must be edited to register this new command and its arguments in the integration?

Accepted Answer

The integration's *.yml file, adding a new command under 'script.commands' with arguments and outputs defined.. Command registration in Cortex XSOAR happens in the integration's YAML definition, specifically under script.commands, where the command name, arguments, and outputs are declared. The Python code implements behavior, but the YAML declaration is what makes the command discoverable in the CLI and playbook editor. Defining arguments and the DBotScore output there ensures the new DeviceID reputation command works end to end.

Answer

The integration's *.yml file, adding a new command block under the 'commands' section.

Answer

The integration's *.py file, adding a new function decorated with @reputation_command.

Answer

The integration's *.json file, adding a new entry to the 'commands' array.

Question 3

A security team wants Cortex XSOAR to automatically create a new incident whenever a threat feed indicator that is already in the Threat Intel database is later seen in a newly ingested indicator from a different feed, so analysts can review the overlap. Which built-in mechanism should the engineer configure to achieve this?

Accepted Answer

A threat intel management rule with a 'Detect' action that triggers when an indicator matches and creates an incident.. Threat intel management rules are the native Cortex XSOAR feature for acting on ingested indicators. A rule with a detect action evaluates conditions such as an indicator matching an existing entry and can automatically create an incident for analyst review. Scheduling, playbook triggers, and lists do not by themselves generate incidents from cross-feed indicator overlap, so the management rule is the right configuration.

Answer

A Cortex XSOAR list named 'overlap_indicators' populated by a custom script that compares feeds on a cron job.

Answer

A playbook trigger configured on the 'Indicator' incident type that runs whenever any indicator is updated.

Answer

A threat intel feed's 'Fetch indicators' schedule, set to run every minute so overlaps are detected quickly.

Question 4

An engineer is configuring a new TAXII 2.1 feed integration in Cortex XSOAR and wants indicators fetched from the collection to be written directly into the Threat Intel database with the feed's own reputation applied, without any manual review step. Which integration parameter must be enabled to achieve this behavior?

Accepted Answer

Enable the 'Create indicators' parameter on the feed integration instance.. Feed integrations in Cortex XSOAR separate the act of retrieving data from the act of persisting indicators. The 'Create indicators' instance parameter is the toggle that writes fetched objects into the Threat Intel database with the feed's reputation, which is exactly what the scenario requires. Fetching and certificate settings affect connectivity and scheduling, while reputation influences scoring rather than persistence.

Answer

Set the feed's 'Fetch indicators' parameter to true and increase the fetch interval.

Answer

Enable 'Trust any certificate (not secure)' in the integration instance settings.

Answer

Set the feed's 'Reputation' parameter to 'Good' so the indicators are trusted by default.

Question 5

A Cortex XSOAR engineer is asked to reduce noise in the Threat Intel database. Several feed integrations are ingesting indicators that overlap with ones already present from higher-fidelity sources, and the team wants to ensure that when two feeds report the same indicator, the more trusted feed's reputation prevails. Which TWO configuration capabilities in Cortex XSOAR help control how conflicting indicator reputations from multiple feeds are resolved? (Choose two.)

Accepted Answer

Leveraging indicator source reliability settings, where each feed can be assigned a reliability rating that influences how its reputation contributions are weighted during aggregation.. Reputation conflict resolution in Cortex XSOAR depends on how each feed's contributed score is weighted. Assigning a Feed Reputation value that mirrors a source's trust level and applying source reliability ratings both influence how overlapping indicators are scored, so the more trusted feed's assessment carries greater weight in the final aggregated reputation.

Answer

Enabling the TLP:RED sharing designation on the trusted feed so its indicators override all other sources in the database.

Answer

Using the Sources section on the indicator and adjusting the score manually for each conflicting indicator as analysts encounter them.

Answer

Configuring indicator expiration rules per feed so stale indicators from lower-fidelity sources age out faster than those from trusted sources.

Question 6

An analyst needs to quickly check how many indicators in the Cortex XSOAR Threat Intel database are of type IP and are currently marked as Bad. Which built-in capability provides this summary without writing a query in the indicator search bar?

Accepted Answer

The Threat Intel page's indicator type filter combined with the reputation filter.. The Threat Intel page includes filters for indicator type and reputation, so an analyst can select IP and Bad to view and count matching indicators. This built-in filtering satisfies the requirement without needing a custom search query or additional configuration. It is the most direct interactive method for summarizing indicators by type and reputation.

Answer

The Widgets library, where a Threat Intel dashboard widget shows counts by type and reputation.

Answer

The Reports page, which includes a prebuilt Threat Intel summary report.

Answer

The Indicator Types settings page, which lists each type with its total count.

Question 7

A junior analyst is investigating an incident and wants to quickly check the reputation of an IP address (198.51.100.22) that appears in multiple alerts. The analyst has not yet added this IP to the Threat Intel database. Which Cortex XSOAR feature allows the analyst to view the reputation and associated indicators for this IP directly from the incident War Room without leaving the incident context?

Accepted Answer

Use the '!ip' command in the War Room CLI to query the IP and display its reputation.. The '!ip' command in the War Room CLI is designed for quick reputation checks of IP addresses using integrated threat intelligence sources. It returns enrichment data without requiring the indicator to be pre-added to the Threat Intel database. This allows analysts to assess indicators in real-time during incident investigation, streamlining the workflow and keeping context within the incident.

Answer

Create a new indicator manually in the Threat Intel page and then view its details.

Answer

Run the 'demisto-research' command in the War Room to perform a reputation lookup.

Answer

Navigate to the Threat Intel page and search for the IP address in the indicator list.

Question 8

A security team ingests indicators from an internal proprietary feed and from a public OSINT feed. Analysts complain that a specific IP address repeatedly flips between 'Malicious' and 'Benign' in the Threat Intel page even though neither feed's data has changed. Which Cortex XSOAR mechanism should the engineer adjust to resolve the conflicting reputation assignments?

Accepted Answer

The feed reputation priority, by assigning the proprietary feed a higher priority so its score takes precedence.. Conflicting reputations from multiple feeds are arbitrated by feed reputation priority, which determines which source's score takes precedence when the same indicator appears in more than one feed. Assigning the authoritative internal feed a higher priority yields a stable, predictable reputation. Expiration, source metadata, and record merging do not govern how competing scores are combined, so they cannot resolve the oscillation.

Answer

The indicator's 'Expiration' field, by reducing the TTL so stale feed data is purged faster.

Answer

The 'Merge indicators' option, by merging the two feed records into a single indicator entry.

Answer

The indicator's 'Source' field, by manually editing it to list only the proprietary feed as the origin.

Question 9

A Cortex XSOAR administrator is designing a workflow to keep the Threat Intel database current. The team wants indicators that have not been observed in any connected feed for 90 days to be automatically removed from the database. Which TWO configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Ensure each feed integration updates the indicator's last seen timestamp on every fetch.. Automatic removal of indicators unseen for 90 days requires two things: the global indicator expiration setting must be set to 90 days, and each feed must refresh the indicator's last seen timestamp on every fetch. The expiration setting defines the policy, while timestamp updates ensure only genuinely stale indicators are removed. Together they enforce the desired retention behavior.

Answer

Enable the indicator auto-expiration checkbox on each feed integration instance.

Answer

Create a scheduled playbook that runs a delete indicators command every 90 days.

Answer

Configure a TAXII collection to push expiration events to the Threat Intel database.

Question 10

A security analyst in Cortex XSOAR is investigating an incident and wants to quickly see all known context about an IP address that appeared in an alert, including its reputation, associated tags, and which feeds have reported it, without leaving the incident war room. Which Cortex XSOAR action provides this consolidated indicator context directly within the incident investigation flow?

Accepted Answer

Hovering over or clicking the IP address entity in the incident's war room entries, which opens a context pane showing reputation, tags, and contributing sources.. Interactive entities in the war room let analysts pivot from a raw value in an alert to its stored threat intel context, including reputation, tags, and contributing sources, without navigating away. This in-flow access supports fast triage decisions and is the intended built-in mechanism for surfacing indicator context during an investigation.

Answer

Opening the Threat Intel page from the left navigation menu and searching for the IP address there.

Answer

Exporting the incident to a report and reviewing the indicator appendix generated at the end of the investigation.

Answer

Running the !ip command in the war room CLI, which returns the full indicator record including feeds and tags.

Question 11

A security operations center (SOC) uses Cortex XSOAR to manage threat intelligence. They have a requirement to automatically share high-severity indicators (score >= 8) with an external partner's MISP instance every hour. Which Cortex XSOAR feature should the engineer use to export these indicators to MISP?

Accepted Answer

Create a scheduled playbook that queries indicators with score >= 8 and uses the MISP integration's 'misp-create-event' command to push them.. To automatically export high-severity indicators to an external MISP instance, a scheduled playbook is the appropriate solution. The playbook can run hourly, query the Threat Intel database for indicators meeting the score threshold, and invoke the MISP integration's 'misp-create-event' command to push them. This provides automation, scheduling, and filtering capabilities. It is a common pattern for sharing threat intelligence with partners.

Answer

Set up a server-side rule in the MISP integration settings to pull indicators from XSOAR every hour.

Answer

Use the 'Export Indicators' button on the Threat Intel page to manually select and send indicators to MISP.

Answer

Configure the MISP integration as a 'Feed' in the Threat Intel management section to automatically export indicators.

Question 12

A Cortex XSOAR engineer is building a workflow that enriches indicators from a new threat feed with relationships to related indicators already in the Threat Intel database. Which TWO capabilities of the threat intel module should the engineer rely on to associate and navigate these relationships? (Choose two.)

Accepted Answer

Indicator relationships, which link indicators so analysts can pivot from one indicator to related ones in the Indicator Details view.. Indicator relationships provide the structured links between indicators and enable pivoting in the Indicator Details view, directly satisfying the association requirement. The Threat Intel page's search and filtering lets analysts locate related indicators by shared attributes, supporting navigation across the database. Tags, reputation scores, and custom fields do not create navigable relationships, so they cannot fulfill the workflow's needs.

Answer

The indicator's reputation score, which changes when related indicators are enriched and thereby implies relationships.

Answer

Indicator tags, which group indicators by arbitrary labels for filtering and exclusion in management rules.

Answer

Custom indicator fields, which can store a related indicator's value as text for reference in layouts.

Question 13

An engineer is writing a custom Python feed integration. After fetching a batch of indicators from an external API, the engineer must push them into the Cortex XSOAR Threat Intel database from within the integration code. Which helper function should be used to create the indicators?

Accepted Answer

demisto.createIndicators() passing the list of indicator dictionaries.. Custom feed integrations persist fetched indicators by calling the createIndicators helper with a list of indicator dictionaries. This writes the batch into the Threat Intel database under the feed's configured reputation and mappings. Return-oriented helpers such as return_results and demisto.results display data but do not create stored indicators, and there is no bulk addIndicator command for this purpose.

Answer

demisto.results() with a list of indicator entries in the entry context.

Answer

demisto.executeCommand('addIndicator', args) for each fetched indicator.

Answer

return_results() with a CommandResults object containing the indicators.

Question 14

A Cortex XSOAR engineer is building an integration that ingests indicators from a partner's REST API. The partner API returns indicators in a custom JSON format, including fields for value, type, and a confidence score. The engineer wants the indicators to appear in the Threat Intel database with the correct type and a reputation derived from the confidence score. Which approach correctly maps the partner's data to Cortex XSOAR indicators?

Accepted Answer

Convert each API record into an indicator object with value and type fields, then call createIndicators, letting the instance's reputation settings compute the score from the confidence field.. To ingest partner indicators, the integration must parse the custom JSON and build indicator objects with explicit value and type fields, then call createIndicators. The instance's reputation settings can translate the partner's confidence score into a Cortex XSOAR reputation. This produces correctly typed indicators with appropriate scores in the Threat Intel database.

Answer

Write the raw JSON records to the war room as a file attachment, then instruct analysts to import them via the Threat Intel page.

Answer

Use the demisto.createIndicators helper with the raw API response directly, since Cortex XSOAR can infer types and scores from arbitrary JSON.

Answer

Store the indicators in the integration's context and configure a playbook to periodically copy them into the Threat Intel database.

Question 15

A SOC uses an XSOAR indicator query to enrich incidents. The engineer needs an indicator to be excluded from future automatic enrichment lookups without deleting it from the Threat Intel database, because it is still referenced by open incidents. Which action should the engineer take on the indicator?

Accepted Answer

Mark the indicator as 'Do Not Enrich' (exclude from enrichment) using the indicator's action menu.. The requirement is to stop an indicator from participating in enrichment while keeping the record available for open incidents. Cortex XSOAR supports an indicator-level exclusion from enrichment, which leaves the indicator in the database and preserves references but prevents enrichment lookups from returning it. That is the least destructive control that matches the stated need.

Answer

Set the indicator's expiration date to a past value so it is treated as expired.

Answer

Lower the indicator's reputation score to 'Unknown' so enrichment skips it.

Answer

Remove the indicator's source feed association to stop enrichment.