2.11 Describe Use and Concepts Related to Using a Threat Intelligence Platform (TIP) to Automate Intelligence 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During an active incident, the incident response team needs to quickly determine if any indicators from a newly published threat report are present in their environment. They have a TIP integrated with their SIEM. What is the fastest way to accomplish this?

   • AIngest the threat report into the TIP, which automatically correlates the indicators with SIEM data and alerts on matches.
   • BManually search the SIEM for each indicator from the report.
   • CUpload the report to the firewall and block all IPs listed.
   • DWait for the next scheduled threat intelligence update from the TIP.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which integration allows a Threat Intelligence Platform (TIP) to automatically update firewall rules with newly discovered malicious IP addresses?

   • AManual copy-paste of IP addresses into the firewall console
   • BUsing a shared USB drive to transfer indicator files
   • CEmailing the firewall administrator with a list of IPs to block
   • DAPI-based integration between the TIP and the firewall management system
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A threat intelligence team is evaluating a TIP and wants to ensure it supports the entire intelligence lifecycle with minimal manual intervention. They have a requirement to produce finished intelligence reports for executives. Which TIP capability is most important for this requirement?

   • AAutomated analysis and report generation from enriched indicators
   • BAutomated ingestion and normalization of indicators
   • CAutomated feedback collection from consumers
   • DAutomated dissemination of raw indicators to security tools
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A threat intelligence analyst is documenting how the organization's TIP supports the intelligence lifecycle. They need to explain how the TIP automates the 'collection' and 'dissemination' stages. Which statement is accurate?

   • AThe TIP automates the feedback stage by sending reports to executives without any analyst review.
   • BThe TIP automatically ingests indicators from multiple feeds and pushes relevant intelligence to the SIEM and SOAR platforms.
   • CThe TIP performs the analysis stage by automatically determining the relevance of each indicator without analyst input.
   • DThe TIP handles the direction stage by automatically setting intelligence requirements based on business goals.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security team wants to ensure that indicators from a new threat feed are automatically checked against their existing indicators to avoid duplicates and identify overlaps. Which TIP function should they configure?

   • AAutomated enrichment of indicators with additional context
   • BAutomated normalization of indicators into a standard format
   • CAutomated dissemination of indicators to all security tools
   • DAutomated correlation and deduplication of indicators
   Reveal Solution Discussion Select an answer first