XSOAR-Engineer Threat Intelligence Management Practice Test 4 — 15 Questions

Question 1

Where can an administrator view summary metrics regarding total indicators, breakdown by type, and top malicious sources in Cortex XSOAR?

Accepted Answer

Threat Intel Dashboards / Overview workspace. Cortex XSOAR exposes threat intel summary metrics — total indicators, breakdown by indicator type, and top malicious sources — through the Threat Intel Dashboards and Overview workspace. This is the dedicated UI surface for aggregated indicator statistics and source reputation. Administrators use it to monitor feed health and indicator volume.

Answer

Automation > Monitoring > Indicator Stats

Answer

Incidents > Metrics

Answer

Settings > About > System Statistics

Question 2

Which TWO factors influence the final calculated reputation score of an indicator when multiple feeds provide conflicting data? Choose 2 answers.

Accepted Answer

Source trust levels and weights. Option A (Source trust levels and weights) is correct because in Cortex XSOAR's indicator scoring, each feed or source is assigned a trust level/weight, and when feeds conflict, the weighted contributions of the higher-trust sources dominate the aggregated reputation calculation. Option C (Indicator scoring rules) is correct because the configured scoring rules (e.g., the reputation calculation logic and thresholds defined in the indicator type's scoring configuration) determine how the individual source scores are combined and normalized into the final reputation value. Option B is incorrect because browser screen resolution is a client display property and has no bearing on server-side reputation computation. Option D is incorrect because the count of open incidents in a War Room is an operational metric, not an input to indicator scoring. Option E is incorrect because the XSOAR server's physical geographic location does not affect how feed data is weighted or scored.

Answer

The resolution of the user's browser screen

Answer

The total number of open incidents in the War Room

Answer

The physical geographic location of the XSOAR server

Question 3

Which THREE parameters are typically required when configuring a generic REST API feed integration instance in Cortex XSOAR? Choose 3 answers.

Accepted Answer

Fetch interval frequency. Option B (Fetch interval frequency) is correct because a generic REST API feed integration must define how often Cortex XSOAR polls the external source for new indicators, typically configured as a fetch interval parameter (e.g., in minutes) that drives the scheduled fetch command. Option C (Feed URL or API endpoint) is correct because the integration needs the base URL or specific REST endpoint to send HTTP/HTTPS requests to and retrieve the indicator data. Option D (Indicator type mapping) is correct because the raw JSON/XML response must be mapped to Cortex XSOAR indicator types (such as IP, Domain, URL, File hash) so the fetched data is stored correctly in the indicators database. Option A (Active directory domain controller IP address) is not required, since a REST API feed integration does not authenticate against AD domain controllers; it uses API keys, tokens, or basic auth configured separately. Option E (Syslog server forwarding port) is not required, as syslog forwarding is a logging/output configuration unrelated to fetching indicators from a REST API feed.

Answer

Active directory domain controller IP address

Answer

Syslog server forwarding port

Question 4

An analyst observes that an indicator's score is fluctuating between malicious and benign because two different feeds report contradictory reputations. How can the administrator enforce that Feed A always takes precedence over Feed B?

Accepted Answer

Configure source weights and precedence in Indicator Scoring settings.. Cortex XSOAR's Indicator Scoring settings allow administrators to assign source weights and precedence, so Feed A's reputation can be configured to override Feed B's when both report on the same indicator. This is the built-in mechanism for resolving contradictory feed reputations without custom code. Deleting feeds or writing playbooks are heavy-handed and do not scale.

Answer

Delete Feed B from the server.

Answer

Write a custom playbook to overwrite scores hourly.

Answer

Modify the incident classification schema.

Question 5

An administrator needs to temporarily disable a noisy threat intelligence feed without losing its configuration settings. What is the correct action?

Accepted Answer

Toggle the 'Fetch indicators' or active status switch off on the integration instance.. Cortex XSOAR integration instances have a 'Fetch indicators' toggle (and an active/enabled state) that stops ingestion without deleting the instance or its configuration. This preserves all feed settings, credentials, and mappings so the feed can be re-enabled later. Deleting the instance or its indicators is destructive and unnecessary for a temporary pause.

Answer

Delete the integration instance entirely.

Answer

Delete all indicators associated with the feed.

Answer

Change the server license to basic mode.

Question 6

Which TWO actions can an administrator perform within the Cortex XSOAR Threat Intel workspace when managing indicators? Choose 2 answers.

Accepted Answer

Perform bulk actions such as tagging or updating reputation. Option B is correct because the Cortex XSOAR Threat Intel workspace supports bulk operations on indicators, allowing an administrator to select multiple indicators and apply actions such as adding tags or updating their reputation score in a single operation. Option C is correct because administrators can manually create new threat indicators directly in the Threat Intel workspace, specifying values, indicator types, and associated metadata rather than relying solely on ingested feeds. Option A is incorrect because firewall routing tables are configured on the firewall or network device itself, not within the XSOAR Threat Intel workspace. Option D is incorrect because core system database storage paths are managed at the operating system or deployment/infrastructure level, not through the Threat Intel indicator management interface. Option E is incorrect because the workspace does not provide a facility to author and execute arbitrary raw Linux shell scripts on remote feed servers; feed integration is handled through configured integrations and scripts within the platform's framework.

Answer

Configure firewall routing tables

Answer

Modify core system database storage paths

Answer

Write raw Linux shell scripts to execute on remote feed servers

Question 7

When troubleshooting a feed integration that fails to parse incoming data, which TWO diagnostic steps should an administrator take? Choose 2 answers.

Accepted Answer

Review the integration instance execution logs for raw response errors.. Option A is correct because the integration instance execution logs capture the raw HTTP response and error details returned by the feed, which is the fastest way to see whether the failure is an authentication, timeout, or malformed-payload issue during parsing. Option E is correct because running the feed query in a standalone test script or inspecting the raw JSON payload lets the administrator validate the response structure against the integration's expected schema and parser logic, isolating whether the problem is in the data or the parsing code. Options B, C, and D are not appropriate: hypervisor upgrades, reinstalling the Cortex XSOAR Linux OS, and changing the network gateway address are infrastructure-level actions unrelated to a feed parsing failure, and they would not diagnose or resolve a malformed or unexpected data payload.

Answer

Upgrade the hypervisor running the virtual machine.

Answer

Reinstall the entire Cortex XSOAR Linux operating system.

Answer

Change the server's primary network gateway IP address.

Question 8

Which TWO details are typically visible within an individual Indicator Details view in Cortex XSOAR? Choose 2 answers.

Accepted Answer

Current reputation and score. Option C is correct because the Indicator Details view in Cortex XSOAR prominently displays the indicator's current reputation (e.g., Good, Suspicious, Bad, Unknown) along with its calculated score, which reflects the aggregated threat intelligence verdict for that IOC. Option D is correct because the Indicator Details view lists the contributing feed sources (such as threat intel feeds and integrations) that supplied or enriched the indicator, allowing analysts to trace provenance and understand which sources influenced the reputation. Options A and B are incorrect because XSOAR does not expose administrator OS login passwords or the XSOAR server's raw BIOS serial numbers within an indicator record; those are unrelated to threat intelligence data. Option E is incorrect because physical GPS coordinates of a threat actor are not a standard field shown in an Indicator Details view, as indicators are technical artifacts (IPs, hashes, domains) rather than geolocation profiles of actors.

Answer

Administrator operating system login passwords

Answer

Raw BIOS serial numbers of the XSOAR server

Answer

Physical GPS coordinates of the threat actor

Question 9

Which THREE configuration settings can be applied to manage indicator lifecycles in Cortex XSOAR? Choose 3 answers.

Accepted Answer

Expiration threshold rules based on last seen time. Option A is correct because Cortex XSOAR indicator lifecycle management lets you define expiration threshold rules that automatically expire or change the status of indicators based on how long it has been since they were last seen (the last seen time), which is a core mechanism for keeping the indicator store current. Option D is correct because analysts can manually override an indicator's reputation or mark it as a false positive, directly changing its lifecycle status and preventing it from triggering future incidents. Option E is correct because XSOAR provides auto-cleanup settings that purge expired indicators from the indicator database on a scheduled basis, removing stale data and reducing noise. Options B and C are not part of indicator lifecycle management: Active Directory group policy synchronization relates to identity/access management, and syslog rotation schedules concern log retention on the logging infrastructure, neither of which controls how indicators expire, are overridden, or are cleaned up in XSOAR.

Answer

Active Directory group policy synchronization

Answer

Syslog rotation schedules

Question 10

Which TWO advanced configurations are required when setting up a TAXII 2.0/2.1 client feed in Cortex XSOAR? Choose 2 answers.

Accepted Answer

TAXII Server URL (Discovery or Collection endpoint). Option A is correct because a TAXII 2.0/2.1 client feed in Cortex XSOAR must be pointed at the TAXII server's Discovery endpoint (e.g., /taxii2/) or a specific Collection endpoint (e.g., /taxii2/collections/{id}/objects/) so the integration can discover API roots/collections and poll STIX objects. Option B is correct because TAXII servers typically require authentication, and the XSOAR TAXII feed configuration supports API Key, Basic Auth, or client Certificate credentials to authorize collection access. Option C is incorrect because TCP window size is an OS/kernel networking tuning parameter, not a TAXII feed setting. Option D is incorrect because local firewall packet filtering is a host/network security control, not part of the XSOAR TAXII client feed configuration. Option E is incorrect because Active Directory domain functional level is unrelated to TAXII threat-intelligence ingestion.

Answer

Kernel-level TCP window size parameters

Answer

Local firewall packet filtering rules

Answer

Active Directory domain functional level

Question 11

Which THREE methods can be used to export threat indicators out of Cortex XSOAR to external systems? Choose 3 answers.

Accepted Answer

Built-in export features in integration instances (e.g., Filebeat, Syslog, or API export). Option B is correct because Cortex XSOAR integration instances such as Filebeat, Syslog, and generic API-based integrations provide built-in export capabilities that forward indicators to external systems. Option C is correct because a TAXII server integration instance in Cortex XSOAR exposes indicators over the TAXII protocol, allowing external threat intelligence platforms to consume them. Option D is correct because playbooks can invoke SIEM or firewall integration commands (push actions) to send indicators to those external systems as part of an automated workflow. Option A is incorrect because flushing server cache with OS kill commands is an administrative action that does not export indicators and could destabilize the server. Option E is incorrect because directly editing PostgreSQL database files bypasses supported APIs, risks corruption, and is not a valid export method.

Answer

Flushing the server cache memory using OS kill commands

Answer

Directly modifying the underlying PostgreSQL database files via text editor

Question 12

Which THREE types of data can be ingested as threat intelligence indicators in Cortex XSOAR out-of-the-box? Choose 3 answers.

Accepted Answer

File hashes (MD5, SHA1, SHA256). Option A (File hashes — MD5, SHA1, SHA256) is correct because Cortex XSOAR's out-of-the-box indicator types include File, which stores MD5, SHA1, and SHA256 hash values used to match malicious files against threat intel feeds. Option C (IP addresses — IPv4 and IPv6) is correct because the built-in IP indicator type natively supports both IPv4 and IPv6 addresses for reputation lookups and enrichment via integrations. Option E (Domain names and URLs) is correct because Cortex XSOAR ships with separate Domain and URL indicator types that can be ingested directly from threat intel feeds and used in playbook logic. Option B (Local network switch port numbers) is not a supported indicator type — port numbers are network configuration data, not threat indicators, and have no built-in indicator schema. Option D (Employee badge access timestamps) is also not an indicator type; it is physical security/HR telemetry that would require custom content and is unrelated to threat intelligence ingestion.

Answer

Local network switch port numbers

Answer

Employee badge access timestamps

Question 13

Which TWO Cortex XSOAR features assist analysts in investigating indicators found in threat feeds? Choose 2 answers.

Accepted Answer

Related incidents list. Option C (Related incidents list) is correct because Cortex XSOAR correlates indicators from threat feeds with existing incidents, letting analysts pivot from an indicator to all incidents that reference it and quickly assess prior investigations and impact. Option D (Indicator relationship graphs and mappings) is correct because XSOAR builds relationships between indicators (for example, domain-to-IP, file-to-C2) and renders them as graphs, and its indicator type mappings normalize feed data so analysts can visualize and traverse these connections during an investigation. The other options do not belong: A (HTML email template designer) is a phishing/notification formatting feature unrelated to indicator investigation, B (Global LDAP user directory sync) only provisions users and roles for authentication, and E (Automatic hypervisor backup scheduling) is not a Cortex XSOAR capability at all.

Answer

HTML email template designer

Answer

Global LDAP user directory sync

Answer

Automatic hypervisor backup scheduling

Question 14

Which TWO considerations are critical when planning custom indicator mapping for a non-standard JSON threat feed? Choose 2 answers.

Accepted Answer

Identifying correct JSONPath expressions for indicator fields. Option D is correct because a non-standard JSON threat feed has no predefined parser, so you must determine the exact JSONPath expressions (e.g., $.data[].attributes.value) that locate each indicator field such as IP, domain, or hash within the nested JSON structure. Option E is correct because once values are extracted, they must be mapped to the standard XSOAR indicator schema attributes (e.g., ip, domain, filehash, or the relevant indicator type fields) so the platform can normalize, deduplicate, and enrich them correctly. Option A is incorrect because custom C++ kernel modules are unnecessary and inappropriate for parsing JSON feed data in XSOAR. Option B is incorrect because modifying the XSOAR source code repository is not required and would break supportability; custom mapping is done through configuration and integration code, not core source edits. Option C is incorrect because hardware load balancers address traffic distribution and availability, not indicator field extraction or schema mapping.

Answer

Writing custom C++ kernel modules for memory parsing

Answer

Modifying the XSOAR source code repository

Answer

Configuring hardware load balancers for the feed server

Question 15

A threat intel analyst at a SOC is reviewing a domain indicator in Cortex XSOAR that has been assigned a score of 3 (Bad). The analyst wants to clearly understand which specific threat feed integration was responsible for assigning that malicious score, so they can evaluate whether the source is trustworthy. Where should the analyst look to determine the origin of the indicator's score in Cortex XSOAR?

Accepted Answer

In the Indicator Details page, under the Sources section, which lists each contributing feed along with its individual score contribution.. The Sources section of an indicator's details page is the authoritative place to see every feed and integration that contributed to the indicator's aggregated reputation, including each source's individual score. Reviewing it lets the analyst attribute the Bad score to a specific feed and judge whether that source's intelligence justifies the malicious classification.

Answer

In the Audit Log, by filtering events for the indicator value and reviewing which integration wrote the reputation field.

Answer

In the Feed Integration instance configuration page, where each feed lists the scores it has assigned to indicators it ingested.

Answer

In the Playground war room, by running the !findIndicators command with the domain as an argument and reading the raw JSON output.