Aggregation, Analysis, and Dissemination Within TIPs TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A TIP is integrated with a SIEM and an EDR. The SIEM receives indicators and creates detection rules, but the EDR does not have an integration with the TIP. The security team wants the EDR to also block malicious files based on TIP indicators. What should the administrator do?

   • ADisable the EDR because it cannot integrate with the TIP.
   • BUse the SIEM as a relay to push indicators to the EDR via its API, if the SIEM supports that integration.
   • CWait for the TIP vendor to release an EDR integration.
   • DManually add the indicators to the EDR's blocklist.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A TIP is integrated with a SIEM. The SIEM team wants to receive real-time alerts when new high-confidence indicators are added to the TIP. What should the TIP administrator configure?

   • AAn automated alerting rule that pushes new high-confidence indicators to the SIEM via the integration.
   • BA manual process where analysts export indicators and the SIEM team imports them.
   • CA report that is generated weekly and stored in a shared folder.
   • DA daily email digest of all new indicators to the SIEM team.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company's TIP is integrated with its SIEM and endpoint detection and response (EDR) platform. The security team wants to automatically block malicious indicators on endpoints, but they are concerned about false positives disrupting business operations. The TIP allows setting confidence thresholds for automated actions. What is the best configuration?

   • ADisable the EDR integration and rely solely on manual blocking
   • BConfigure the SIEM to automatically block endpoints without a confidence threshold
   • CSet a low confidence threshold for automated blocking to maximize security
   • DSet a high confidence threshold for automated blocking in the EDR integration, while sending lower-confidence indicators to the SIEM for analyst review
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center (SOC) ingests threat data from a commercial feed, an open-source feed, and internal firewall logs into its threat intelligence platform. Analysts complain that the same indicator appears multiple times with different formats (e.g., IP addresses with and without leading zeros, domain names in uppercase and lowercase). The SOC manager wants to ensure that when an analyst searches for an indicator, all related observations appear in a single result. What should the SOC manager configure in the TIP?

   • ANormalization rules that standardize indicator formats and deduplicate equivalent values
   • BA dissemination rule that sends all indicator matches to the analyst's email
   • CA correlation engine that links indicators based on shared threat actor names
   • DAn enrichment service that adds geolocation and reputation scores to each indicator
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat intelligence team has finished analyzing a new malware campaign and needs to ensure that the SOC analysts receive the indicators in their SIEM, the incident response team gets a detailed report, and the executive team receives a high-level summary. The TIP supports integrations with SIEM, email, and ticketing systems. What is the most efficient way to achieve this?

   • AConfigure multiple dissemination workflows that push tailored intelligence to each audience via the appropriate integration
   • BExport the indicators to a CSV file and attach it to a single email to all stakeholders
   • CSend the full technical report to all stakeholders via email
   • DPublish the indicators only in the TIP's web interface and notify stakeholders to log in
   Reveal Solution Discussion Select an answer first