Aggregation, Analysis, and Dissemination Within TIPs TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A TIP analyst is correlating indicators from a new campaign. The TIP's correlation engine has linked several IPs and hashes, but the analyst notices that one IP is shared with a legitimate web hosting service. The analyst wants to avoid false positives in the final intelligence product. What should the analyst do?

   • AManually review the correlation results and add context notes indicating that the IP is shared infrastructure, then adjust the confidence score accordingly.
   • BRemove the IP from the correlation results entirely to avoid confusion.
   • CAutomatically block the IP because it is part of the campaign.
   • DIncrease the correlation threshold so that only exact matches are considered.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization subscribes to multiple threat intelligence feeds. The TIP is configured to pull data from these feeds every hour. However, analysts notice that some indicators from a specific feed are missing from the TIP's database. The feed's API documentation indicates that it uses a different authentication method and returns data in a custom JSON format. What is the most likely cause of the missing indicators?

   • AThe TIP's connector for that feed is not properly configured to authenticate or parse the custom format
   • BThe TIP's dissemination workflow is not sending the indicators to the SIEM
   • CThe TIP's normalization rules are converting the indicators to an incompatible format
   • DThe TIP's analysis engine is filtering out the indicators as false positives
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a common workflow integration between a TIP and a security orchestration, automation, and response (SOAR) platform?

   • AThe SOAR platform replaces the TIP's aggregation and normalization functions
   • BThe SOAR platform performs deep analysis of malware samples and sends results to the TIP
   • CThe TIP provides enriched threat intelligence that triggers automated playbooks in the SOAR platform
   • DThe TIP stores all security logs from the SOAR platform for long-term retention
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A threat intelligence analyst is investigating a suspicious domain that appeared in a phishing email. The TIP has ingested DNS records, certificate transparency logs, and threat feeds. The analyst wants to determine whether the domain is part of a known infrastructure cluster and identify related domains. Which TIP capability should the analyst use?

   • AAggregation to pull additional raw logs from the email server
   • BDissemination to share the domain with other analysts
   • CEnrichment to add a reputation score from a single feed
   • DCorrelation and context building to link the domain to related indicators and campaigns
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A TIP administrator is aggregating data from a commercial threat feed that provides indicators with a high false-positive rate. The feed is ingested into the TIP and correlated with internal data. The administrator wants to reduce the noise in the TIP while still retaining the feed for future analysis. What should the administrator do?

   • AApply a confidence threshold during ingestion to filter out low-confidence indicators, but store the raw feed in a separate collection for later analysis.
   • BRemove the feed entirely because it has a high false-positive rate.
   • CIngest all indicators without any filtering and let analysts deal with the noise.
   • DIncrease the polling frequency for the feed to get more data.
   Reveal Solution Discussion Select an answer first