XSOAR-Engineer Threat Intelligence Management Practice Test 5 — 15 Questions

Question 1

A Cortex XSOAR engineer configures a new TAXII 2.1 feed using the TAXII2 Server integration. The feed instance connects successfully, but the engineer notices that indicators already present in the Threat Intel database from other sources are not being linked to the new feed's source. Which setting on the feed instance must be reviewed to ensure existing indicators are associated with this feed's source?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'Source' parameter, which defines the source name used when ingesting indicators and associates them with this feed.. The Source parameter on a feed instance determines the source label applied to indicators ingested by that feed. When an indicator already exists in the Threat Intel database, the feed's source is added to the indicator's source list, creating the association. Without the correct Source value, existing indicators will not be linked to the new feed, even though the feed fetches successfully.

Answer

The 'Fetch indicators' checkbox, which enables or disables the periodic fetching of indicators from the TAXII server.

Answer

The 'Update existing indicators' checkbox, which controls whether fetched indicators update existing database entries.

Answer

The 'Indicator Reputation' parameter, which assigns a reputation score to newly ingested indicators.

Question 2

A Cortex XSOAR engineer is using the built-in TAXII2 integration to pull indicators from a partner's server. The partner recently started publishing indicators with the STIX pattern type 'network-traffic' (for IP-and-port combinations), but these objects never appear on the Threat Intel page even though other indicator types from the same collection arrive normally. The feed instance shows a successful fetch with no errors. What is the most likely cause?

Accepted Answer

The TAXII2 integration only ingests STIX objects whose pattern type is mapped to a supported indicator type; unsupported pattern types such as network-traffic are skipped during parsing.. The TAXII2 integration converts STIX patterns into Cortex XSOAR indicators by mapping recognized pattern types. Objects whose pattern type has no mapping, such as network-traffic, are skipped without error, so the feed reports success while those indicators never appear. The other explanations would affect either the entire fetch or the UI, neither of which matches a type-specific gap.

Answer

The TAXII2 server is rate-limiting the collection, so only the first N objects per poll are returned.

Answer

The partner's collection uses a TAXII 2.0 endpoint, and the integration instance is configured for TAXII 2.1, which cannot read 2.0 objects.

Answer

The Threat Intel page requires a manual refresh after each fetch and hides newly added indicator types until the next scheduled run.

Question 3

An analyst is investigating a phishing incident and wants to determine which threat intelligence sources have reported a specific IP address as malicious. The IP indicator exists in the Threat Intel database. Which action should the analyst take to view the list of sources that contributed to this indicator's reputation?

Accepted Answer

Open the indicator's details page and review the 'Sources' field, which lists all feeds and manual entries that reported the indicator.. The Sources field on an indicator's details page is the authoritative place to see all feeds and manual entries that have reported the indicator. It aggregates every source that contributed to the indicator's presence and reputation, enabling analysts to assess which threat intelligence sources consider the IP malicious. This is the most direct and accurate method.

Answer

Run the '!ip' command in the CLI to query the indicator and view its reputation score.

Answer

Navigate to the Threat Intel page and apply a filter by the indicator's value to see all related incidents.

Answer

Check the incident's War Room entries for any feed integration logs that mention the indicator.

Question 4

A security team notices that a domain indicator's reputation score in Cortex XSOAR keeps dropping from Bad to Suspicious, then returning to Bad, even though no analyst has manually changed it. The domain is reported by two feeds: Feed A assigns a Bad reputation, and Feed B assigns a Benign reputation. Both feeds are configured with the same expiration and both run every hour. What is the most likely cause of the fluctuating score?

Accepted Answer

The indicator's score is recalculated each time a feed updates it, and the last feed to report wins, so the score alternates based on feed execution order.. Cortex XSOAR recalculates an indicator's score whenever a feed updates it, and with multiple feeds reporting conflicting reputations, the score reflects whichever feed last wrote to the indicator. If feed execution order varies, the reputation oscillates between the values associated with each feed. The fix is to use indicator scoring rules or feed precedence rather than relying on last-write-wins behavior.

Answer

The Threat Intel database is corrupted, causing score recalculation failures that randomly reset the indicator's reputation.

Answer

Expiration settings for the two feeds differ, so the indicator expires and is recreated with a default score on each cycle.

Answer

The indicator has been added to a manual allow list, which overrides feed scores intermittently when the allow list sync runs.

Question 5

A security engineer is integrating a new TAXII 2.1 feed into Cortex XSOAR. The feed requires authentication using a client certificate and a private key. After configuring the integration instance with the correct certificate and key, the engineer notices that no indicators are being fetched, and the integration logs show 'SSL certificate verification failed'. The TAXII server uses a self-signed certificate. What should the engineer do to resolve this issue while maintaining security best practices?

Accepted Answer

Import the TAXII server's self-signed certificate into the Cortex XSOAR trusted certificates store and reference it in the integration.. To securely connect to a TAXII server with a self-signed certificate, the certificate must be imported into Cortex XSOAR's trusted certificates store. This allows the integration to validate the server's identity without disabling SSL verification. The integration instance can then reference the imported certificate. This approach maintains encryption and authentication integrity while resolving the SSL error.

Answer

Generate a new client certificate signed by the TAXII server's CA and use it in the integration configuration.

Answer

Modify the integration's Python code to use 'verify=False' in the requests library calls.

Answer

Disable SSL verification in the integration instance settings by checking 'Trust any certificate'.

Question 6

A security team wants to ensure that indicators ingested from a newly integrated MISP feed are automatically tagged with a specific label for easier filtering and correlation. Which configuration on the MISP feed instance in Cortex XSOAR allows the engineer to apply a custom tag to all indicators from this feed?

Accepted Answer

The 'Tags' parameter, which allows specifying a comma-separated list of tags to apply to all fetched indicators.. The Tags parameter on a feed instance is designed to apply a custom set of tags to all indicators fetched by that feed. By configuring this parameter with the desired label, the engineer ensures every indicator from the MISP feed carries that tag, enabling easy filtering, correlation, and playbook triggers based on the tag.

Answer

The 'Indicator Type' parameter, which defines the type of indicators to fetch (e.g., IP, Domain).

Answer

The 'Feed Name' parameter, which sets the display name of the feed in the Threat Intel page.

Answer

The 'Fetch Interval' parameter, which controls how often the feed is polled for new indicators.

Question 7

An engineer is building a custom indicator type for 'CryptocurrencyAddress' and wants Cortex XSOAR to automatically extract these values from incident evidence and enrich them. The engineer has created the indicator type and a reputation command. Which additional configuration is required so that the platform automatically identifies CryptocurrencyAddress values in new incidents and runs the reputation command?

Accepted Answer

Add the indicator type to the 'Indicator Extraction' rules with a regex and associate the reputation command in the indicator type settings.. Automatic identification of a custom indicator type requires an extraction rule that maps a regex pattern to the CryptocurrencyAddress indicator type, plus associating the reputation command with that type. Extraction rules scan incident evidence at creation time and tag matching values as indicators, while the linked reputation command provides enrichment. Configuring both makes the platform detect and enrich the values automatically, rather than relying on manual analyst action or unrelated playbook steps.

Answer

Create a new playbook that calls the reputation command and set it as the default incident playbook.

Answer

Add the indicator type to the 'Reputation' settings and enable 'Auto-extract indicators' in the integration parameters.

Answer

Define the indicator type in the 'Indicator Types' page and enable 'Automatic enrichment' on the type, which alone triggers extraction.

Question 8

A security team wants to share indicators from Cortex XSOAR with an external partner's TAXII 2.1 server and also push indicators to a SIEM via a supported export mechanism. Which TWO Cortex XSOAR capabilities support exporting threat indicators to external systems? (Choose two.)

Accepted Answer

The 'TAXII2 Server' integration, which exposes a TAXII endpoint for consumers to pull indicators.. Sharing indicators outward is accomplished with the TAXII2 Server integration, which exposes a pull endpoint for external consumers, and with the Export Indicators command, which writes indicators to STIX, CSV, or JSON files for downstream systems. Both are supported export capabilities. The Get, Add, and Delete Indicators commands operate inward or on lifecycle management and do not deliver indicator data to external systems, so they do not meet the sharing requirement.

Answer

The 'Add Indicators' command, which inserts new indicators into the database from external sources.

Answer

The 'Delete Indicators' command, which removes indicators after they are shared.

Answer

The 'Get Indicators' command, which retrieves indicators from the database for review.

Question 9

An engineer is configuring indicator expiration for a threat feed. The organization wants indicators from this feed to expire 30 days after they are last seen in the feed. The engineer sets the 'Expiration' parameter to 30 days on the feed instance. However, after 30 days, indicators are still present in the Threat Intel database. Which factor is most likely preventing the expiration from occurring?

Accepted Answer

The indicators are also reported by another feed with a longer expiration, so the platform retains them until all sources expire.. Indicator expiration in Cortex XSOAR is calculated per source, and the indicator's overall expiration is the latest expiration among all sources. If another feed reports the same indicator with a longer or no expiration, the indicator persists until that source expires. This multi-source expiration model explains why setting 30 days on one feed may not remove the indicator.

Answer

The 'Expiration' parameter requires a restart of the feed integration to take effect.

Answer

The 'Expiration' parameter on the feed instance only applies to indicators that are no longer in the feed, but the feed still reports them.

Answer

The feed's 'Expiration' parameter is overridden by the global indicator expiration policy in Settings > Threat Intel.

Question 10

An engineer needs Cortex XSOAR to enrich every newly ingested indicator from an external feed by querying an internal WHOIS service before the indicator is stored, and to block ingestion if enrichment fails. The WHOIS service is exposed through a custom integration. Which approach best meets this requirement?

Accepted Answer

Modify the custom feed integration so it calls the WHOIS integration during fetch and only returns indicators that enrich successfully, discarding failures.. To block ingestion based on enrichment outcome, the validation must occur before indicators are handed to the platform. Embedding the WHOIS call in the custom feed integration's fetch flow and emitting only successfully enriched indicators achieves this. Management rules and reputation commands operate after storage, and the described feed setting does not exist, so those approaches cannot prevent unenriched indicators from being stored.

Answer

Create a threat intel management rule that runs a script calling the WHOIS integration and only permits storage when the call succeeds.

Answer

Enable 'Enrich indicators' in the feed instance settings and set the enrichment timeout to zero so failures abort the fetch.

Answer

Configure the feed integration to run in 'indicator reputation' mode so enrichment is performed by the reputation command automatically.

Question 11

A Cortex XSOAR engineer is reviewing an incident and wants to see the enrichment details for a specific IP indicator, including which integrations produced scores and when the indicator was last seen. From the incident's indicator list, which action opens the full Indicator Details view for that IP?

Accepted Answer

Click the indicator value in the incident's Indicators tab to open its details page.. From an incident, the Indicators tab lists the extracted indicators, and clicking an indicator's value opens its full Indicator Details page. That page consolidates the reputation, per-integration DBotScore contributions, related incidents, and timestamps like last seen. The other choices either print tabular CLI output, navigate to a different global area, or re-run enrichment without showing stored details, so they do not open the details view for the IP.

Answer

Open the Threat Intel page and use the global search to find the IP.

Answer

Run the '!ip' reputation command directly in the war room CLI.

Answer

Run the '!getIndicators' command in the CLI and read the output table.

Question 12

A Cortex XSOAR engineer must ensure that indicators from a high-confidence internal feed are never automatically expired by threat intel management rules, even when they have not been seen for a long period. Which configuration achieves this?

Accepted Answer

Create a threat intel management rule with higher priority that tags these indicators and excludes tagged indicators from expiration rules.. Threat intel management rules evaluate conditions and apply actions, and expiration rules can be scoped to exclude tagged indicators. A high-priority rule that tags the trusted internal feed's indicators, combined with an expiration rule that skips tagged indicators, explicitly prevents automatic expiry while leaving other feeds governed normally. Feed settings and global period changes cannot guarantee exemption, and disabling the engine is too broad.

Answer

Disable the threat intel management rule engine entirely so no expiration rules run.

Answer

Set the feed's indicator expiration to 'never' in the feed integration instance settings.

Answer

Increase the indicator expiration period to a very large value in the global indicator settings.

Question 13

An engineer configured a feed integration with the 'Indicator Reputation' parameter set to 'Bad' and 'Expiration' set to 30 days. After a week, analysts report that indicators from this feed still appear in the database long after the feed stopped returning them, and some indicators have a reputation of 'Good' from another source. Which behavior explains why the indicators persist and how reputation is determined?

Accepted Answer

Expiration resets each time the feed returns the indicator, and the final reputation is the combined DBotScore from all contributing sources.. Feed-based expiration counts from the last time the feed observed the indicator, so each sighting resets the 30-day timer and indicators persist while the feed keeps returning them. Reputation is the combined DBotScore from all contributing sources, so a Good score from another integration can result in a Good displayed reputation even though this feed assigns Bad. The other choices misstate expiration scope or reputation aggregation and therefore do not match the observed behavior.

Answer

Expiration only applies to indicators with a reputation of 'Unknown', and reputation is set by the most recently updated feed.

Answer

Expiration is a global setting that overrides feed-level values, and reputation is locked to the first source that reported the indicator.

Answer

Expiration is measured from when the indicator was first created, and reputation is always the feed's configured value regardless of other sources.

Question 14

A junior analyst needs to look up whether a suspicious file hash has been seen in any ingested threat feeds and wants to see the associated feed sources, first-seen date, and current reputation in a single view. Where in Cortex XSOAR should the analyst navigate?

Accepted Answer

The Threat Intel page, by searching for the hash and opening its indicator details.. The Threat Intel page is the repository for ingested indicators and provides a details view consolidating reputation, feed sources, and timestamps for a given value. Searching the hash there yields exactly the feed provenance and scoring information the analyst needs. The Playground, Incidents page, and Marketplace serve execution, case management, and content installation respectively, none of which present a unified indicator record.

Answer

The Marketplace, by locating the feed pack that likely contains the hash.

Answer

The Incidents page, by searching for incidents that contain the hash in their details.

Answer

The Playground, by running a command against the hash and reading the raw output.

Question 15

An engineer must design a workflow that exports Cortex XSOAR threat indicators to two external systems: a SIEM that ingests indicators via a REST API, and a partner organization that consumes indicators through a TAXII 2.1 server. Which TWO Cortex XSOAR capabilities should the engineer use to implement these outbound integrations? (Choose two.)

Accepted Answer

A custom integration or script that calls the SIEM's REST API to push indicators on a schedule.. Outbound indicator sharing requires mechanisms that transmit data externally. Acting as a TAXII 2.1 server lets a partner poll selected indicators in a standard format, while a custom integration or script that calls the SIEM's REST API delivers indicators to that system on a schedule. Inbound creation toggles, expiration rules, and Playground execution do not export indicators, so they cannot fulfill either leg of the requirement.

Answer

Enabling the 'Create indicators' parameter on the internal feed instances to broadcast indicators outward.

Answer

Using the Playground to manually run enrichment commands that forward indicators to external APIs.

Answer

Configuring indicator expiration rules to push expired indicators to external consumers.