2.11 Describe Use and Concepts Related to Using a Threat Intelligence Platform (TIP) to Automate Intelligence 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team wants to reduce the number of false positives in their SIEM by adding context to raw indicators before they are used in detection rules. Which TIP function should they enable?

   • ANormalization of indicators into a standard format
   • BEnrichment of indicators with threat actor, malware family, and confidence scores
   • CDissemination of indicators to the SIEM
   • DCorrelation of indicators with internal vulnerability data
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A threat hunting team wants to proactively search for indicators of compromise (IOCs) that have not yet triggered alerts. They have a TIP that aggregates indicators from multiple sources. Which TIP feature would most directly support this proactive hunting activity?

   • AAutomated sharing of indicators with external partners
   • BAutomated correlation of indicators with internal telemetry to identify potential matches
   • CAutomated blocking of all indicators on the firewall
   • DAutomated generation of executive reports on threat trends
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization is evaluating a TIP to reduce the noise from multiple threat intelligence feeds. They notice that different feeds use different formats (CSV, STIX, JSON) and have overlapping indicators. What is the primary TIP function that addresses this challenge?

   • ANormalization and deduplication
   • BThreat hunting
   • CAutomated blocking
   • DIndicator sharing
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations team receives threat intelligence from multiple commercial and open-source feeds in different formats (STIX, CSV, JSON). They want to reduce manual effort in converting these feeds into a consistent format for their SIEM. Which TIP capability should they prioritize?

   • AAutomated dissemination of indicators to the SIEM
   • BManual review and approval workflow for all indicators
   • CIntegration with a SOAR platform for automated response
   • DAutomated normalization and enrichment of indicators
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does automation enhance the use of a TIP in incident response?

   • ABy generating a weekly report of all incidents
   • BBy storing incident data in a separate database
   • CBy eliminating the need for human analysts in the response process
   • DBy automatically correlating indicators with active incidents and suggesting containment actions
   Reveal Solution Discussion Select an answer first