Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team uses a TIP to manage indicators and a SIEM to generate alerts. They want to automatically block a malicious IP on the firewall when the SIEM detects a high-severity event involving that IP. The TIP does not have a native firewall integration. What is the most appropriate way to achieve this?

   • AManually copy the IP from the SIEM alert to the firewall management console
   • BCreate a new indicator in the TIP and hope that the firewall automatically picks it up
   • CUse a SOAR platform to orchestrate the workflow: receive the SIEM alert, query the TIP for context, and call the firewall API to block the IP
   • DConfigure the SIEM to directly send a block command to the firewall using its built-in firewall integration
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat intelligence team wants to measure the effectiveness of their automation and orchestration efforts. They want to track the number of alerts processed automatically, the time saved, and the number of false positives. They also want to identify areas for improvement. What is the best way to achieve this?

   • AGenerate automated reports that include these metrics and review them regularly
   • BUse the SIEM to generate all these metrics
   • CManually track these metrics in a spreadsheet
   • DOnly track the number of false positives
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team has implemented a playbook that automatically blocks IP addresses based on threat intelligence feeds. However, they are experiencing a high number of false positives, causing legitimate services to be blocked. What is the best practice to address this issue?

   • ABlock all IP addresses from the feed without any filtering
   • BIncrease the frequency of feed updates to get more indicators
   • CRemove the automation and manually block all IP addresses
   • DAdd a condition to the playbook that requires a minimum confidence score before blocking
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a playbook designed for alert triage, what is the typical first step after an alert is triggered?

   • ANotify the legal department.
   • BEnrich the involved indicators with threat intelligence data.
   • CDelete the alert from the system.
   • DAutomatically block all associated IP addresses.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is implementing automated incident response for ransomware alerts. They want to automatically isolate affected hosts and collect memory dumps. However, they are concerned about the risk of isolating a critical production server that is not actually compromised. What is the best practice to mitigate this risk?

   • AOnly collect memory dumps and skip isolation to avoid disruption
   • BUse the TIP to determine which hosts to isolate
   • CInclude a manual approval step in the playbook before isolating critical assets
   • DAutomatically isolate all hosts without any approval to speed up response
   Reveal Solution Discussion Select an answer first