2.11 Describe Use and Concepts Related to Using a Threat Intelligence Platform (TIP) to Automate Intelligence 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which stage of the intelligence lifecycle involves converting raw data into a format that can be analyzed?

   • ADissemination
   • BProcessing
   • CFeedback
   • DCollection
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which set of functions is typically performed by a Threat Intelligence Platform (TIP)?

   • AVulnerability scanning, patch management, and asset inventory
   • BPacket capture, protocol analysis, and traffic replay
   • CIngestion, normalization, enrichment, and sharing of threat intelligence
   • DLog aggregation, alert correlation, and incident ticketing
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat hunting team wants to use the TIP to proactively search for indicators of compromise (IOCs) in their environment. They have a large number of IOCs from multiple sources. What is the most efficient way to use the TIP for this purpose?

   • AUse the TIP to directly query endpoint logs without involving the SIEM.
   • BAsk the TIP to automatically block all matching IPs on the firewall without further analysis.
   • CManually copy the IOCs from the TIP into a spreadsheet and search each one individually in the SIEM.
   • DAutomatically push the IOCs from the TIP to the SIEM and use the SIEM's query capabilities to search for matches in logs.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company uses a TIP to ingest indicators from multiple sources. They want to automatically push high-confidence indicators to their firewall and EDR, but only after a security analyst approves them. Which TIP workflow configuration best meets this requirement?

   • AManual ingestion of all indicators, then automated dissemination after correlation
   • BFully automated ingestion, correlation, and dissemination with no human intervention
   • CAutomated ingestion and correlation, then a manual approval step before dissemination to firewall and EDR
   • DAutomated ingestion and dissemination, but correlation performed only during weekly threat hunting sessions
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC wants to automate the creation of tickets and the blocking of malicious IPs when a high-severity indicator is received. They have a TIP, a SIEM, and a SOAR platform. What is the most effective way to orchestrate this workflow?

   • AUse the TIP to send the indicator to the SOAR, which triggers a playbook that creates a ticket and updates the firewall.
   • BConfigure the TIP to directly create tickets in the ticketing system and block the IP on the firewall without involving the SOAR.
   • CHave the SIEM directly block the IP on the firewall and create a ticket, bypassing the TIP and SOAR.
   • DManually create a ticket and block the IP after reviewing the indicator in the TIP.
   Reveal Solution Discussion Select an answer first