Aggregation, Analysis, and Dissemination Within TIPs TIE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In the context of a threat intelligence platform (TIP), what does the term 'aggregation' specifically refer to?

   • AThe process of collecting threat data from multiple sources and converting it into a consistent format
   • BThe process of correlating indicators with internal security event logs to identify active threats
   • CThe process of manually reviewing each threat indicator to determine its relevance to the organization
   • DThe process of distributing finished intelligence reports to stakeholders via email and dashboards
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A threat intelligence team is evaluating a new TIP. They want to ensure that data from their existing threat feeds, which use STIX/TAXII, can be imported. They also want to ensure that the TIP can enrich indicators with data from internal vulnerability scanners. Which capability should the team verify in the TIP?

   • AA built-in vulnerability scanner that runs inside the TIP
   • BSupport for STIX/TAXII connectors and API-based enrichment integrations
   • CA correlation engine that matches indicators to vulnerability scanner logs
   • DA dissemination workflow that sends indicators to the vulnerability scanner
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat intelligence analyst is reviewing a report about a new ransomware family. The TIP has aggregated data from multiple sources, including sandbox reports, domain registrations, and threat feeds. The analyst wants to create a comprehensive profile of the ransomware, including its behavior, associated infrastructure, and likely victims. Which TIP feature should the analyst use to assemble this information?

   • ANormalization to standardize the format of the indicators
   • BAggregation to pull more raw data from additional sources
   • CDissemination to share the report with other teams
   • DContext building to combine related indicators and reports into a single threat profile
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A threat intelligence team is preparing to disseminate a time-sensitive alert about an active zero-day exploit. The alert must reach the SOC immediately, but the team also wants to provide a detailed analysis report to the executive team. The TIP supports email, SIEM integration, and a web portal. The SOC uses the SIEM for alerts, and executives prefer email summaries. What is the best dissemination strategy?

   • AUse the TIP's correlation engine to generate a report and send it to the SIEM
   • BPush the alert to the SIEM for immediate SOC notification and send a tailored email summary to executives
   • CSend the full detailed report via email to both the SOC and executives
   • DPublish the alert only on the web portal and notify both teams to check it
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A global company's TIP is used by security teams in three regions. The threat intelligence team wants to disseminate a new report about a targeted attack. The report contains sensitive information about internal vulnerabilities. The team must ensure that only the incident response team in the affected region can view the full report, while other regions should only see a summary. The TIP supports role-based access control and distribution lists. What is the best approach?

   • ASend the full report to all regions and rely on the recipients to handle it responsibly
   • BCreate two versions of the report and use distribution lists to send the full version only to the affected region's incident response team and the summary to all other regions
   • CPublish the full report on the TIP's public portal and notify all regions
   • DUse the TIP's correlation engine to automatically redact the report for all regions
   Reveal Solution Discussion Select an answer first