Aggregation, Analysis, and Dissemination Within TIPs TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company uses a TIP to manage threat intelligence. The security team wants to automatically block malicious IP addresses in the firewall as soon as they are confirmed by the TIP's analysis. The TIP has an API and supports integrations with the firewall vendor. What should the security team configure?

   • AAn aggregation rule that imports firewall logs into the TIP
   • BAn automated dissemination workflow that sends confirmed indicators to the firewall via the TIP's integration
   • CAn enrichment query that adds firewall rules to the TIP's database
   • DA manual process where analysts copy indicators from the TIP and paste them into the firewall
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is configuring a TIP to aggregate threat data from multiple sources. One source is a high-volume feed that provides millions of indicators daily, but many are duplicates or low-quality. Another source is a curated feed with high-confidence indicators but limited volume. The team wants to reduce noise in the TIP while ensuring that high-confidence indicators are not missed. What is the best approach?

   • AIngest only the curated feed and ignore the high-volume feed entirely
   • BUse the TIP's dissemination rules to send all indicators to the SIEM for manual review
   • CIngest all data from both feeds without any filtering
   • DConfigure aggregation rules that deduplicate and filter low-confidence indicators from the high-volume feed, while preserving all indicators from the curated feed
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is migrating from a legacy threat intelligence tool to a new TIP. The legacy tool exports indicators in a proprietary format. The new TIP supports STIX/TAXII and CSV import. The team wants to preserve the historical intelligence data and ensure it is usable in the new TIP. What is the best approach?

   • AImport the proprietary format directly into the new TIP
   • BManually re-enter all historical indicators into the new TIP
   • CDiscard the historical data and start fresh with the new TIP
   • DConvert the proprietary format to STIX/TAXII using a conversion tool, then import it into the new TIP
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A TIP is integrated with a threat intelligence sharing platform (e.g., MISP). The TIP receives indicators from MISP and also publishes its own indicators back to MISP. The administrator wants to ensure that indicators published to MISP are enriched with context from the TIP. What should the administrator do?

   • AManually copy the indicators and context into MISP.
   • BDisable the export integration to avoid sharing too much information.
   • CPublish raw indicators without any context to MISP.
   • DConfigure the TIP's export integration to include enrichment data such as tags, comments, and related indicators when publishing to MISP.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which TIP capability is primarily used to add additional context to a raw indicator, such as geolocation, WHOIS data, or associated malware family?

   • ADeduplication
   • BEnrichment
   • CAggregation
   • DDissemination
   Reveal Solution Discussion Select an answer first