Palo Alto Networks XSOAR-Engineer Exam - Topic 3 Question 18 Discussion

XSOAR's Threat Intelligence module represents connections between indicators---such as domain IP mappings---using relationships. The Admin Guide explains that relationships have attributes including direction, type, and state, allowing analysts to mark them as active or inactive. When an observed association (such as a malicious domain pointing to a particular IP address) is no longer valid, the platform provides the ability to revoke the relationship, which sets its state to inactive without deleting the indicator or removing historical context.

Revoking is the correct method because it preserves historical intelligence for correlation, investigations, and audit trails while preventing outdated relationships from impacting enrichment or automated processes.

Updating the relationship type (option B) merely changes classification, not the state. Expiring the IP address indicator (option C) affects the indicator itself---not the relationship---and does not correctly mark that the specific association has ended. Updating the description (option D) is cosmetic only and does not change operational behavior.

Thus, revoking the relationship (option A) is the documented and proper way to inactivate a domain--IP connection in XSOAR.