Aggregation, Analysis, and Dissemination Within TIPs TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations team uses a TIP to ingest threat feeds from multiple commercial vendors, open-source lists, and internal firewall logs. Analysts complain that the same indicator appears with different formats (e.g., '1.2.3.4' vs '1.2.3.4/32') and different confidence scores depending on the source. They want a single, deduplicated view with a unified confidence score. What should the TIP administrator configure to address this?

   • AExport all indicators to a spreadsheet and use Excel formulas to remove duplicates and average the confidence scores.
   • BCreate separate collections for each source so analysts can manually compare the raw indicators and decide which confidence score to trust.
   • CSet up a normalization and deduplication pipeline that maps each source's indicator format to a canonical schema and applies a source-credibility weighting to derive a composite confidence score.
   • DDisable all sources except the one with the highest confidence scores to eliminate conflicts.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations center uses a TIP to manage threat intelligence. The SOC manager wants to ensure that when a new high-severity indicator is added to the TIP, the on-call analyst is immediately notified via a mobile alert, and the indicator is automatically added to the SIEM's watchlist. The TIP supports webhooks and SIEM integration. What should the SOC manager configure?

   • AA dissemination rule that triggers a webhook notification and a SIEM integration update when a high-severity indicator is published
   • BAn enrichment query that adds the indicator to the TIP's threat profile
   • CAn aggregation rule that imports the indicator from the SIEM into the TIP
   • DA correlation rule that links the indicator to existing campaigns
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A TIP administrator is integrating a new open-source threat feed that provides indicators in CSV format with columns: 'ip', 'domain', 'hash', 'first_seen', 'last_seen', and 'tags'. The TIP's native schema requires indicators to have a type (IP, domain, hash) and a confidence score. The feed does not provide confidence scores. The administrator wants to use this feed for both automated blocking and analyst research. What is the best approach?

   • AReject the feed because it does not provide confidence scores.
   • BConfigure the TIP to infer the indicator type from the column that is populated and assign a default low confidence score, then mark the feed as 'unverified' for analyst review.
   • CImport the feed as a raw CSV file and have analysts manually classify each indicator.
   • DAssign a high confidence score to all indicators because the feed is open-source and widely used.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A TIP is configured to automatically push indicators to a firewall and a SIEM. The firewall is down for maintenance, and the SIEM is receiving the indicators. The TIP administrator wants to ensure that the firewall receives the indicators once it is back online. What should the administrator do?

   • AManually export the indicators to a file and upload them to the firewall later.
   • BDisable the firewall integration until it is back online.
   • CIgnore the failure because the SIEM has the indicators.
   • DConfigure the TIP to queue and retry failed integrations until the firewall is available.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is investigating a suspicious domain that was flagged by a threat feed. The analyst wants to know if the domain is associated with any known malware families, who registered it, and whether it has been seen in any internal network traffic. What should the analyst do within the TIP?

   • ADelete the domain from the TIP because it is not immediately actionable.
   • BCreate a new indicator for the domain and manually add all the information from memory.
   • CExport the domain to a CSV file and email it to the threat intelligence team for manual analysis.
   • DUse the TIP's enrichment and context-building features to pull WHOIS data, malware family associations, and search internal logs for the domain.
   Reveal Solution Discussion Select an answer first