Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security operations center (SOC) uses a TIP, a SIEM, and a firewall. They want to automate the containment of compromised hosts. The SOC has a SOAR platform but is considering whether to use it or to implement direct integrations between the TIP and the firewall. What is the most important consideration when choosing between these approaches?

   • ADirect TIP-to-firewall integration is always faster and more reliable
   • BThe SIEM should be the primary orchestrator for containment actions
   • CThe TIP should directly block hosts on the firewall without involving other tools
   • DThe SOAR platform provides a centralized point for managing and auditing the entire response workflow
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security organization has implemented multiple automation tools and integrations over time, resulting in overlapping and sometimes conflicting automated actions. For example, both the TIP and the SOAR platform can block IPs on the firewall, leading to inconsistent rules. What is the best practice to address this issue?

   • AUse the SIEM to consolidate all automated actions
   • BDefine clear ownership and a single orchestration layer to manage all automated actions
   • CDisable all automation and use manual processes
   • DAllow both tools to continue operating independently
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A SOAR playbook automatically contains a compromised host by isolating it on the network. However, the playbook runs on every alert that mentions the host, even if the alert is a low-severity false positive. This has caused unnecessary isolation of critical servers. What is the most effective way to refine the playbook?

   • AChange the playbook to isolate the host for a shorter time period
   • BAdd a condition that only triggers containment for alerts with a severity above a defined threshold and a confirmed malicious indicator
   • CAdd a manual approval step for every containment action
   • DRemove the containment step from the playbook and only send an email notification
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security team has deployed three different SOAR platforms across different business units, each with its own playbooks and integrations. They are now struggling to maintain consistent response processes and reporting. What is the best practice to address this tool sprawl?

   • AKeep the three platforms but create a manual process to align playbooks
   • BConsolidate to a single SOAR platform and standardize playbooks and integrations across all business units
   • CUse the TIP as a central reporting tool to aggregate metrics from all three SOAR platforms
   • DDisable automation in two of the platforms and only use the third for all responses
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which element is essential in a playbook that automates indicator enrichment?

   • AA step that manually reviews each indicator in a spreadsheet.
   • BA step that changes the indicator's format to a proprietary standard.
   • CA step that deletes the indicator after enrichment.
   • DA step that queries external threat intelligence sources for additional context.
   Reveal Solution Discussion Select an answer first