2.11 Describe Use and Concepts Related to Using a Threat Intelligence Platform (TIP) to Automate Intelligence 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the intelligence lifecycle, what is the primary purpose of the 'direction' stage?

   • ATo collect raw data from various sources
   • BTo analyze processed data to produce intelligence
   • CTo share intelligence with relevant stakeholders
   • DTo define the intelligence requirements and priorities
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of a Threat Intelligence Platform (TIP) in a security operations environment?

   • ATo aggregate threat intelligence from multiple sources, correlate it, and automate its use across security tools
   • BTo store raw network packets for forensic analysis
   • CTo automatically patch vulnerabilities in endpoints
   • DTo replace the SIEM by providing real-time log analysis and alerting
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization is implementing a TIP to support its intelligence lifecycle. They want to ensure that the 'processing' stage is automated as much as possible. Which TIP capability is most relevant to this stage?

   • AAutomated generation of executive reports
   • BAutomated blocking of all indicators on firewalls
   • CAutomated normalization and enrichment of raw indicators
   • DManual analyst review of every indicator
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does a Threat Intelligence Platform (TIP) integrate with a SOAR platform to enable automated threat response?

   • AThe TIP directly patches endpoints without involving the SOAR
   • BThe SOAR sends raw logs to the TIP for storage
   • CThe TIP provides enriched intelligence that the SOAR uses to trigger and execute response playbooks
   • DThe TIP replaces the SOAR in orchestrating incident response
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's SOC uses a TIP to manage threat intelligence. They want to automatically block malicious IPs on their perimeter firewall when the TIP receives a high-confidence indicator from a trusted feed. However, they also want to avoid blocking critical business partners. What is the best way to achieve this?

   • AUse the TIP to block the IPs only after a SOAR playbook manually approves each block.
   • BConfigure the firewall to pull indicators directly from the raw threat feed, bypassing the TIP.
   • CHave the TIP send all indicators to the SIEM, and let analysts manually decide which IPs to block on the firewall.
   • DConfigure the TIP to push all high-confidence IP indicators to the firewall, and maintain an allowlist in the firewall to prevent blocking critical partners.
   Reveal Solution Discussion Select an answer first