2.11 Describe Use and Concepts Related to Using a Threat Intelligence Platform (TIP) to Automate Intelligence 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC wants to automate the dissemination of indicators to their SIEM, firewall, and EDR, but only for indicators that are relevant to their industry. Which TIP feature would allow them to filter indicators based on industry relevance?

   • ATagging and filtering indicators based on sector or industry tags
   • BNormalizing all indicators into a common format
   • CEnriching indicators with threat actor information
   • DCorrelating indicators with internal vulnerability data
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A multinational company has a TIP that aggregates intelligence from regional feeds. They want to automate the dissemination of indicators to their regional firewalls, but they have different compliance requirements in different regions. Some regions require that certain data not leave the region. What is the best way to handle this?

   • APush all indicators to all firewalls regardless of region.
   • BManually review and distribute indicators to each region.
   • CDeploy regional TIP instances or use the TIP's filtering capabilities to ensure that only regionally relevant indicators are shared with each firewall.
   • DUse a single global firewall and ignore regional requirements.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company wants to use its TIP for proactive defense by automatically updating its intrusion prevention system (IPS) with new indicators. However, they are concerned about the risk of blocking legitimate traffic due to false positives. What is the best practice to mitigate this risk while maintaining automation?

   • ADisable the IPS and rely on manual review of all indicators.
   • BConfigure the TIP to push only high-confidence indicators to the IPS, and maintain an allowlist for critical assets.
   • CPush all indicators to the IPS without any filtering.
   • DUse the TIP to block all traffic from countries listed in the threat feed.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team is implementing a TIP and wants to automate the 'feedback' stage of the intelligence lifecycle. They want to use feedback from incident response to improve future intelligence. What is the best way to achieve this?

   • AIntegrate the TIP with the SOAR platform so that incident response outcomes are automatically sent back to the TIP to adjust confidence scores.
   • BHave analysts manually update the TIP with lessons learned after each incident.
   • CUse the TIP to automatically block all indicators that were involved in past incidents.
   • DDisable the feedback stage because it is not important.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company has a TIP integrated with a SIEM and a SOAR. During an incident, the SOC wants to automatically isolate infected hosts based on indicators from the TIP. However, the network team is concerned about isolating critical production servers. Which approach best balances automated response with the network team's concern?

   • AConfigure the SOAR playbook to isolate hosts only if they are not in a protected list of critical servers
   • BConfigure the TIP to directly isolate any host that matches an indicator
   • CConfigure the TIP to block network traffic to the infected host instead of isolating it
   • DConfigure the SIEM to alert on matches but require manual isolation for all hosts
   Reveal Solution Discussion Select an answer first