2.11 Describe Use and Concepts Related to Using a Threat Intelligence Platform (TIP) to Automate Intelligence 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is an example of automation in a Threat Intelligence Platform (TIP)?

   • AManually reviewing each indicator and deciding whether to block it
   • BStoring indicators in a database without any processing
   • CAutomatically ingesting indicators from a threat feed and correlating them with internal security events
   • DGenerating a monthly report of all threat feeds
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How does a Threat Intelligence Platform (TIP) automate the dissemination of threat intelligence to security tools?

   • ABy sending emails to security administrators with a list of indicators
   • BBy requiring analysts to manually export indicators and import them into each tool
   • CBy using integrations and APIs to push indicators to firewalls, SIEMs, and other tools
   • DBy storing indicators in a shared spreadsheet that tools can read
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which statement best describes the role of a Threat Intelligence Platform (TIP) in an organization's security architecture?

   • AIt is a vulnerability scanner that identifies weaknesses in the network
   • BIt acts as a central hub that collects, correlates, and disseminates threat intelligence to enable automated defense
   • CIt is a firewall that blocks malicious IP addresses based on internal rules
   • DIt is a database that stores only open-source threat feeds without any processing
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security operations team receives daily CSV files of indicators from a government threat-sharing group, but the team is overwhelmed by the volume and manually pastes them into the SIEM. They also subscribe to a commercial feed that uses STIX/TAXII. The team wants to reduce manual effort and ensure indicators are automatically available to their SIEM and firewall. Which approach should they take?

   • AAsk the government group to send indicators in STIX/TAXII format and then manually upload them to the firewall.
   • BConfigure the TIP to ingest both feeds, normalize them, and push indicators to the SIEM and firewall via automated integrations.
   • CUse the SIEM's built-in parser to ingest the CSV files and manually forward the STIX/TAXII feed to the firewall.
   • DCreate a SOAR playbook that reads the CSV files and directly updates the SIEM, bypassing the TIP.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is using a TIP to support incident response. During an active incident, they receive a new threat report with indicators that may be related. The team wants to quickly check if these indicators are present in their environment, but they also want to avoid triggering a large number of false positives from the SIEM. What is the best approach?

   • AUse the SOAR to automatically quarantine all endpoints that match any indicator.
   • BPush all indicators from the report to the firewall and block them immediately.
   • CIngest the report into the TIP and use its correlation with the SIEM to identify only indicators that have been observed in the environment.
   • DManually search the SIEM for each indicator, one by one.
   Reveal Solution Discussion Select an answer first