XSOAR-Engineer Threat Intelligence Management — Timed 10 Questions

Question 1

An analyst wants to view the historical reputation changes of a specific malicious IP address over time. Which tab within the Indicator Details page provides this timeline?

Accepted Answer

Timeline or History tab. The Reputation or History tab in the Indicator Details page displays the audit trail of score updates and source contributions.

Answer

Raw Data tab

Answer

Workplan tab

Answer

Related Incidents tab

Question 2

When configuring a feed integration instance, the administrator selects 'Trust level' as 'Good'. How does this affect the indicator's calculated score when conflicting with a malicious feed?

Accepted Answer

It assigns a higher weight to trusted sources, potentially overriding lower-trust malicious feeds.. Trust levels in XSOAR determine how indicator scores from various sources are weighed and resolved during reputation calculation.

Answer

It causes the indicator score to be permanently locked to 0 regardless of other feeds.

Answer

It disables feed fetching for that specific indicator value.

Answer

It automatically deletes the indicator if any other feed reports it as malicious.

Question 3

A security analyst notices that indicators fetched from a specific OSINT feed are overriding higher-confidence internal indicators. Where should the administrator configure indicator scoring rules to resolve this?

Accepted Answer

Settings > Advanced > Indicator Scoring. Indicator scoring rules in Cortex XSOAR allow administrators to assign weights and precedence to different indicator sources to manage conflicts.

Answer

Settings > Object Fields > Indicators

Answer

Settings > Integrations > Instances

Answer

Settings > Advanced > Indicator Types

Question 4

An administrator needs to ingest a custom JSON threat feed that does not conform to standard out-of-the-box integrations. Which integration type should be built or configured to handle this custom structure?

Accepted Answer

Generic Feed integration using the GenericFeed module. The Generic Feed integration allows administrators to map custom JSON, CSV, or XML structures to XSOAR indicator fields using JSONPath or regex.

Answer

Standard Syslog integration parser mapping

Answer

Threat Intel Management API endpoint receiver

Answer

Custom REST API automation script executed via timer triggers

Question 5

An administrator needs to run a query in the Threat Intel workspace to find all active IP indicators with a 'Bad' reputation associated with a specific campaign tag. Which search syntax is correct?

Accepted Answer

type:IP and reputation:Bad and tag:CampaignX. XSOAR indicator queries utilize specific syntax such as type:IP and reputation:Bad combined with tag filters.

Answer

indicator.type == 'IP' & rep == 3

Answer

find ip where status = bad and campaign = CampaignX

Answer

ip = malicious AND tag == CampaignX

Question 6

An analyst identifies a false positive indicator that is currently marking legitimate outbound traffic as malicious. What action should the analyst take to neutralize its effect globally in XSOAR?

Accepted Answer

Update the indicator reputation to Benign or False Positive.. Whitelisting or marking an indicator as 'False Positive' or changing its score to 0/Benign updates its reputation across the platform.

Answer

Delete the incident associated with the indicator.

Answer

Export the indicator to a CSV file for manual review.

Answer

Disable the active playbook attached to the threat intel module.

Question 7

An organization wants to expire indicators automatically if they have not been seen in any incoming feeds for 90 days. Where is this expiration threshold configured?

Accepted Answer

Settings > Advanced > Indicator Types. Indicator expiration rules are managed globally or per indicator type under Advanced settings in Cortex XSOAR.

Answer

Automation > Scripts > Expiration Script

Answer

Threat Intel > Indicator Queries > Expiration

Answer

Settings > About > Server Configuration

Question 8

An XSOAR administrator has integrated a new TAXII server feed, but indicators are not populating in the Threat Intel page. Which component must be verified first to ensure ingestion is functioning?

Accepted Answer

Verify that the fetch indicators setting is enabled on the integration instance configuration.. Feed integration instances in XSOAR rely on enabled fetch indicators settings and valid instance configurations to pull data into the Threat Intel page.

Answer

Restart the entire Cortex XSOAR server container service.

Answer

Disable all pre-built indicator types to avoid parsing conflicts.

Answer

Ensure the default incident classification scheme maps TAXII records to custom layouts.

Question 9

An analyst wants to bulk update the tags of 500 indicators selected from a Threat Intel query result. Which feature should be used?

Accepted Answer

Select the indicators in the Threat Intel grid and click the 'Tag' bulk action button.. Cortex XSOAR provides bulk action capabilities in the Threat Intel workspace to tag, untag, or modify indicator reputations.

Answer

Create a scheduled job in Settings > Advanced > Jobs.

Answer

Export indicators to CSV, modify the tags in Excel, and re-import as incidents.

Answer

Run a Python script using demisto.executeCommand() for each indicator ID individually.

Question 10

A feed integration is pulling indicators successfully, but the correlation rules are not triggering when new incidents are created with matching observables. What is the most likely cause?

Accepted Answer

Indicator matching is disabled globally or the incident type is not configured to correlate indicators.. Indicator matching against incidents requires indicator auto-extract or matching configurations to be active in incident types or server settings.

Answer

Indicators must be manually pushed to the incident war room using a CLI command.

Answer

The XSOAR server license has expired for threat intelligence modules.

Answer

The feed source uses STIX 1.x instead of STIX 2.1 format.