Aggregation, Analysis, and Dissemination Within TIPs TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A TIP analyst notices that a single IP address appears in a phishing campaign feed, a malware analysis report, and an internal intrusion detection alert. The analyst wants to determine if these are related to the same threat actor. What TIP analysis feature should the analyst use?

   • AWorkflow integration that pushes the IP to the SIEM for further investigation.
   • BCorrelation engine that links indicators across different sources based on shared attributes.
   • CEnrichment service that adds geolocation and WHOIS data to the IP address.
   • DDissemination report that summarizes all indicators in the TIP.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company is deploying a TIP and wants to ensure that it can ingest data from a variety of sources, including email gateways, DNS logs, and threat feeds. The team is concerned about the volume of data and wants to ensure that the TIP can handle the load without performance degradation. What is the most important factor to consider?

   • AThe TIP's cost
   • BThe TIP's ability to generate reports
   • CThe TIP's user interface design
   • DThe TIP's scalability and performance capabilities, such as support for distributed processing and load balancing
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An organization uses a TIP, a SIEM, and an EDR platform. The TIP receives indicators from external feeds and internal investigations. The security team wants the SIEM to automatically create detection rules based on new high-confidence indicators from the TIP. What should the administrator configure?

   • AA bidirectional integration between the TIP and SIEM that allows the TIP to push indicators and the SIEM to create rules automatically.
   • BA report that is emailed to the SIEM team daily.
   • CA manual process where analysts copy indicators from the TIP into the SIEM.
   • DA one-way integration from the SIEM to the TIP only.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A threat intelligence team is required to share threat intelligence with external partners, such as industry peers and government agencies. The team must ensure that sensitive information, such as internal system names, is not disclosed. The TIP supports data marking and sharing groups. What is the best approach?

   • AShare all intelligence with external partners without any restrictions
   • BUse the TIP's correlation engine to automatically remove sensitive information
   • CManually review and redact each report before sharing
   • DUse data marking to tag sensitive information and configure sharing groups that exclude marked data from external dissemination
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization's TIP is configured to ingest indicators from a SIEM, a threat feed, and a vulnerability scanner. The SIEM sends events in real time, the threat feed updates every hour, and the vulnerability scanner runs daily. The TIP is currently set to poll all sources every 24 hours. Analysts are missing timely indicators from the SIEM. What should the administrator do to improve timeliness without overloading the TIP?

   • ADisable the vulnerability scanner source because it is not as time-sensitive.
   • BIncrease the polling interval for all sources to every 12 hours to balance load.
   • CSet all sources to poll every 5 minutes to ensure no data is missed.
   • DConfigure the SIEM source to push or be polled at a higher frequency (e.g., every 5 minutes), while keeping the threat feed and vulnerability scanner on their existing schedules.
   Reveal Solution Discussion Select an answer first