XSOAR-Engineer Threat Intelligence Management Practice Question
An enterprise uses Cortex XSOAR to synchronize indicators to multiple firewall enforcement points. A feed pushes indicators with a custom attribute. How can the administrator ensure this custom attribute is included in the exported TAXII/STIX bundle?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
By configuring the indicator mapping in the export integration instance settings.
Custom indicator fields must be mapped within the feed or export integration mapping settings to be included in STIX/TAXII export bundles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
By adding the attribute to the incident layout editor.
Why it's wrong here
Incident layouts do not control STIX export schemas.
- ✓
By configuring the indicator mapping in the export integration instance settings.
Why this is correct
Export integrations require explicit mapping definitions to include custom indicator fields in outgoing bundles.
- ✗
By modifying the server configuration key 'vim.export.custom.fields'.
Why it's wrong here
Export mappings are handled in integration instance settings, not general server config keys.
- ✗
By writing a post-processing automation script that directly injects XML tags into the firewall API.
Why it's wrong here
Export mapping should be configured via built-in integration mapping settings rather than custom parsing scripts.
About these practice questions
One of 219 original XSOAR-Engineer practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XSOAR-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XSOAR-Engineer exam.