A fintech team ingests two vendor intelligence feeds into the Secure Firewall Management Center using Threat Intelligence Director. The high-confidence feed arrives as a TAXII collection and its traffic must be blocked, the lower-confidence feed should only raise events, and nobody may retype the indicators by hand. Which Threat Intelligence Director action plan applies Monitor and Block correctly?

The correct plan separates ingestion from enforcement: both TAXII sources are received in monitor mode, avoiding a blanket source-level action, and the high-confidence feed’s simple indicators and observables are then selected for blocking. This preserves visibility into the lower-confidence feed without turning its matches into blocks, and requires no manual re-entry of indicators. The plan that blocks only the high-confidence feed’s simple indicators leaves its observables in monitor mode, so it does not apply the requested action to both indicator types. The plan that sets the lower-confidence source to block contradicts the requirement that it only raise events; selectively blocking the high-confidence feed does not undo that over-enforcement. The plan that blocks the high-confidence feed’s observables but leaves its simple indicators monitored provides only partial coverage, so the required blocking treatment is incomplete. Exam caveat: source-level actions and indicator-level actions are distinct controls, and a source configured to block can affect its indicators broadly rather than only a chosen subset. Practical check: review the deployed source actions and resulting indicator classifications, then test representative matches from each feed to confirm that high-confidence matches block and lower-confidence matches generate events only.