2.11 Describe Use and Concepts Related to Using a Threat Intelligence Platform (TIP) to Automate Intelligence 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is a common use case for a Threat Intelligence Platform (TIP)?

   • APerforming penetration testing of web applications
   • BManaging user access permissions in Active Directory
   • CReplacing the need for endpoint protection software
   • DProactive defense by identifying and blocking indicators before they are used in attacks
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security operations center uses a TIP to automate the dissemination of indicators to its EDR and firewall. They notice that the EDR is receiving too many alerts, causing alert fatigue. They want to reduce the noise while still maintaining effective detection. What is the best approach?

   • AUse the TIP to apply a confidence threshold and only push high-confidence indicators to the EDR, while sending all indicators to the SIEM for analysis.
   • BDisable the EDR integration and rely only on the firewall.
   • CManually review each indicator before pushing to the EDR.
   • DPush all indicators to both the EDR and firewall without any filtering.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small security team is considering investing in a TIP. They currently receive threat intelligence from several open-source feeds and a commercial feed, but they struggle to correlate the data and identify relevant threats. Which benefit of a TIP directly addresses this challenge?

   • AReplacing the need for a SIEM
   • BGuaranteeing that all indicators are false positives
   • CProviding a direct connection to law enforcement databases
   • DAggregation and correlation of intelligence from multiple sources into a single view
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a TIP integrated with its SIEM and SOAR. They want to automate blocking of malicious domains on their DNS firewall, but they are concerned about the impact on business operations if a legitimate domain is blocked. They also want to ensure that the response is consistent across all locations. What is the best way to achieve this?

   • AHave the TIP directly block domains on the DNS firewall without any allowlist.
   • BUse the SOAR playbook to push high-confidence domains to the DNS firewall, with an allowlist for critical business domains.
   • CUse the SIEM to send blocking commands to the DNS firewall, bypassing the SOAR and TIP.
   • DManually update the DNS firewall at each location based on TIP reports.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is configuring a TIP to automate the ingestion of indicators from multiple sources. They notice that some sources provide indicators with low confidence scores, and they want to avoid overwhelming their SIEM with low-value data. They also need to ensure that important indicators are not missed. What is the best configuration strategy?

   • ASet a confidence threshold for forwarding indicators to the SIEM, but also create a separate feed for low-confidence indicators that analysts can review.
   • BManually review every indicator before forwarding to the SIEM.
   • CForward all indicators to the SIEM regardless of confidence.
   • DDiscard all low-confidence indicators without review.
   Reveal Solution Discussion Select an answer first