XSOAR-Engineer Threat Intelligence Management Practice Test 3 — 15 Questions

Question 1

A Cortex XSOAR engineer is configuring a new TIM (Threat Intel Management) feed integration for a premium vendor that requires the same API token to be reused across multiple feed instances. During the first fetch, the integration returns HTTP 429 with a Retry-After header. The engineer wants the feed to back off and retry automatically without losing the last fetch timestamp. Which configuration on the feed integration instance should the engineer verify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the 'Advanced: Fetch interval' and 'Advanced: Retry' parameters are set so the integration honors Retry-After and resumes from the stored last-fetch time.. Feed integrations expose dedicated fetch interval and retry controls that govern polling cadence and how transient HTTP responses are handled. When the vendor returns 429 with Retry-After, the integration must be allowed to wait and resume from its stored last-fetch position, otherwise indicators that arrived during the backoff window could be missed. Verifying those advanced parameters is the correct remediation.

Answer

Set the 'First fetch timestamp' to a value in the past and enable 'Fetch indicators'.

Answer

Change the integration's 'Source Reliability' to F - Unreliable to suppress the errors.

Answer

Configure the 'Advanced: Maximum number of incidents per fetch' parameter on the instance.

Question 2

A Cortex XSOAR analyst wants to see which of the currently ingested indicators have been observed in more than one feed, so they can prioritize high-confidence indicators. Which TIM feature should the analyst use to view indicators that appear across multiple sources?

Accepted Answer

The 'Sources' field on the Indicator Details page, which lists every feed that contributed the indicator.. The Indicator Details page maintains a Sources field that aggregates every feed integration that contributed the indicator. When the same indicator is ingested by more than one feed, each feed is recorded, giving the analyst a direct view of cross-feed corroboration. This is the intended TIM feature for identifying indicators observed across multiple sources.

Answer

The 'Feed' column on the Threat Intel page, sorted alphabetically.

Answer

The 'Audit Trail' on the indicator, which logs every feed fetch event.

Answer

The 'Related Incidents' tab, which shows incidents that referenced the indicator.

Question 3

An analyst wants to view the historical reputation changes of a specific malicious IP address over time. Which tab within the Indicator Details page provides this timeline?

Accepted Answer

Timeline or History tab. The Reputation or History tab in the Indicator Details page displays the audit trail of score updates and source contributions.

Answer

Raw Data tab

Answer

Workplan tab

Answer

Related Incidents tab

Question 4

When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?

Accepted Answer

It assigns a higher weight to trusted sources, potentially overriding lower-trust malicious feeds.. Trust levels in XSOAR determine how indicator scores from various sources are weighed and resolved during reputation calculation.

Answer

It causes the indicator score to be permanently locked to 0 regardless of other feeds.

Answer

It disables feed fetching for that specific indicator value.

Answer

It automatically deletes the indicator if any other feed reports it as malicious.

Question 5

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

Accepted Answer

Generic Feed integration using the GenericFeed module. The Generic Feed integration allows administrators to map custom JSON, CSV, or XML structures to XSOAR indicator fields using JSONPath or regex.

Answer

Standard Syslog integration parser mapping

Answer

Threat Intel Management API endpoint receiver

Answer

Custom REST API automation script executed via timer triggers

Question 6

An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?

Accepted Answer

Update the indicator reputation to Benign or False Positive.. Whitelisting or marking an indicator as 'False Positive' or changing its score to 0/Benign updates its reputation across the platform.

Answer

Delete the incident associated with the indicator.

Answer

Export the indicator to a CSV file for manual review.

Answer

Disable the active playbook attached to the threat intel module.

Question 7

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Accepted Answer

Verify that the fetch indicators setting is enabled on the integration instance configuration.. For TAXII feed integrations in Cortex XSOAR, the integration instance has a 'Fetch indicators' toggle that must be enabled for the integration to poll the TAXII server and ingest indicators into the Threat Intel database. If it is disabled, the integration may test successfully but no indicators will populate.

Answer

Restart the entire Cortex XSOAR server container service.

Answer

Disable all pre-built indicator types to avoid parsing conflicts.

Answer

Ensure the default incident classification scheme maps TAXII records to custom layouts.

Question 8

A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?

Accepted Answer

Indicator matching is disabled globally or the incident type is not configured to correlate indicators.. Indicator matching against incidents requires indicator auto-extract or matching configurations to be active in incident types or server settings.

Answer

Indicators must be manually pushed to the incident war room using a CLI command.

Answer

The XSOAR server license has expired for threat intelligence modules.

Answer

The feed source uses STIX 1.x instead of STIX 2.1 format.

Question 9

When setting up a new threat intelligence feed, what parameter determines how far back in time the integration pulls historical indicators upon initial run?

Accepted Answer

Lookback period or First fetch parameter. The 'First fetch' (also called lookback period or 'fetch from') parameter controls how far back in time the integration retrieves indicators on its very first run, e.g., '7 days' or a specific date. Subsequent runs use the fetch interval to pull only new indicators since the last fetch.

Answer

Fetch Interval frequency

Answer

Maximum Indicator Limit

Answer

Indicator Expiration Timer

Question 10

An administrator notices that duplicate indicators are being created from multiple feeds with slightly different formatting (e.g., lowercase vs uppercase domains). How does Cortex XSOAR handle indicator deduplication?

Accepted Answer

It automatically normalizes and merges indicator entries based on type-specific normalization rules.. Cortex XSOAR automatically normalizes and merges indicator entries based on type-specific normalization rules. For example, domains are lowercased, IP addresses are canonicalized, and hashes are standardized. This deduplication ensures that the same indicator from different feeds is represented as a single record, with aggregated data and reputation.

Answer

It rejects the second feed entirely if a similar string exists.

Answer

It creates separate indicator records for every variation to preserve raw feed data.

Answer

It requires a manual merge action via the Threat Intel UI for every duplicate.

Question 11

An analyst wants to manually add a single known malicious domain to the Threat Intel database. Which method is most direct?

Accepted Answer

Navigate to Threat Intel > Indicators > New Indicator.. Indicators can be created manually directly from the Threat Intel workspace using the 'New Indicator' button.

Answer

Modify the server configuration file via SSH.

Answer

Create a dummy incident and run a War Room command.

Answer

Import a full STIX 2.1 bundle via API.

Question 12

When exporting indicators from Cortex XSOAR to an external SIEM using a TAXII server integration, the recipient reports missing custom fields. What configuration must be checked?

Accepted Answer

The STIX/TAXII server configuration mapping rules for outgoing indicator properties.. When Cortex XSOAR exports indicators to an external TAXII server, the STIX/TAXII server configuration includes mapping rules that determine which indicator properties are serialized into STIX objects. If custom fields are missing on the recipient side, the outgoing mapping is the first place to verify that those fields are included in the STIX pattern and object properties. The other options relate to unrelated subsystems (proxy, layouts, Syslog parsing) that do not affect TAXII export content.

Answer

The server-wide proxy exception list.

Answer

The global incident layout settings.

Answer

The SIEM parser configuration for incoming Syslog messages.

Question 13

A scheduled feed is failing with a certificate verification error because the feed source uses an internal self-signed SSL certificate. How can an administrator resolve this in Cortex XSOAR?

Accepted Answer

Disable SSL verification in the integration instance configuration parameters if the option is available, or add the CA certificate to the trust store.. Custom or self-signed certificates must be added to the XSOAR server trust store or the integration instance must have certificate validation disabled if supported.

Answer

Delete the integration instance and recreate it using HTTP instead of HTTPS.

Answer

Increase the timeout threshold in server configuration.

Answer

Modify the feed provider's web server configuration.

Question 14

Which indicator type should an administrator select when configuring a feed that supplies malicious URL strings?

Accepted Answer

URL. Cortex XSOAR includes predefined indicator types such as URL, IP, Domain, and File Hash.

Answer

IP

Answer

File Hash

Answer

Domain

Question 15

An organization uses a custom threat feed that updates via an API requiring OAuth2 authentication with token rotation. How should the administrator configure this integration instance?

Accepted Answer

Provide the client ID, client secret, and token URL in the integration instance configuration fields designed for OAuth2.. Cortex XSOAR integration instances support OAuth2 authentication natively through dedicated configuration fields for client ID, client secret, token URL, and scopes. The integration engine handles token acquisition and automatic refresh/rotation, so the administrator should populate these fields rather than embedding credentials in code or managing tokens externally. This is the secure, supported pattern for API integrations requiring OAuth2 with token rotation.

Answer

Hardcode the Bearer token into the integration script source code.

Answer

Write a cron job on the host OS to generate tokens and write them to a shared file.

Answer

Configure a separate incident classification rule to handle authentication headers.