Aggregation, Analysis, and Dissemination Within TIPs TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company's TIP is integrated with its SIEM and ticketing system. When the TIP identifies a new malicious domain, the SIEM should automatically create a ticket for the incident response team. However, the tickets are not being created. The TIP's integration logs show that the SIEM received the indicator successfully. What is the most likely issue?

   • AThe SIEM is not normalizing the indicator correctly
   • BThe TIP's analysis engine is not correlating the domain with existing threats
   • CThe TIP's aggregation is not pulling the domain from the threat feed
   • DThe TIP's dissemination workflow is not configured to trigger the ticketing system integration
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A TIP administrator is configuring a new threat feed that provides indicators in STIX 2.1 format. The TIP's native schema uses an older custom format that lacks several STIX fields, such as 'kill chain phases' and 'granular markings'. The administrator wants to preserve as much context as possible for downstream analysis. What should the administrator do?

   • AReject the feed because the TIP cannot support STIX 2.1 natively.
   • BMap the STIX fields to the closest native fields and store the raw STIX bundle as an attachment for reference.
   • CConvert the STIX bundle to CSV and import only the fields that match the native schema.
   • DAsk the feed provider to send the data in the TIP's custom format instead.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following best describes the dissemination function in a threat intelligence platform?

   • ACollecting raw data from multiple external sources and storing it in a central repository
   • BEnriching indicators with additional context from third-party databases
   • CDelivering tailored intelligence to relevant stakeholders through reports, alerts, and automated feeds
   • DCorrelating indicators with internal security logs to identify active compromises
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In a threat intelligence platform, what is the primary purpose of correlation during the analysis phase?

   • ATo send alerts to security teams when a known indicator is detected
   • BTo convert raw data from various sources into a single standardized format
   • CTo identify relationships between seemingly unrelated indicators and uncover broader attack patterns
   • DTo remove duplicate indicators from the threat intelligence database
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does a TIP typically support the aggregation process through workflow integration with external threat intelligence feeds?

   • ABy requiring analysts to manually copy indicators from each feed into the TIP
   • BBy sending all collected indicators directly to the SIEM without processing
   • CBy storing all raw feed data in its original format without any transformation
   • DBy using APIs or standardized protocols to automatically pull indicators from multiple feeds
   Reveal Solution Discussion Select an answer first