Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   Which of the following is a best practice for implementing automation and orchestration in threat intelligence?

   • AStart with small, well-defined workflows and gradually expand.
   • BAvoid using any human oversight in automated workflows.
   • CAutomate all processes at once to maximize efficiency.
   • DUse as many different orchestration tools as possible to cover all needs.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A threat intelligence team wants to automate the sharing of indicators with external partners. They want to share only indicators that have been verified as malicious and have a confidence score above 80. They also want to automatically revoke sharing if an indicator is later found to be a false positive. What is the best way to configure this in the TIP?

   • AShare all indicators with external partners and manually revoke false positives
   • BUse a single rule that shares indicators and automatically revokes them after a set time
   • CCreate a sharing rule with conditions for verification and confidence, and a separate rule to revoke sharing on false positive detection
   • DShare only indicators with a confidence score above 80, without verification
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   What is the primary purpose of integrating a TIP with a firewall?

   • ATo automatically block traffic from malicious IP addresses identified in threat intelligence.
   • BTo provide a backup for firewall logs.
   • CTo replace the firewall's rule base with the TIP's database.
   • DTo allow the firewall to generate threat intelligence reports.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   How does orchestration streamline incident response in threat intelligence?

   • ABy automating evidence collection and containment actions across multiple tools.
   • BBy eliminating the need for incident response plans.
   • CBy focusing only on post-incident reporting.
   • DBy requiring analysts to manually perform each step in a predefined order.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A threat intelligence team wants to automatically generate a weekly report showing the number of indicators ingested, enriched, and blocked, as well as the number of false positives. They want this report to be emailed to management every Monday. What is the best way to achieve this?

   • ACreate a dashboard in the TIP and share it with management
   • BUse the SIEM to generate the report from its logs
   • CManually compile the report each week from TIP data
   • DConfigure a scheduled report in the TIP that runs weekly and emails the results
   Reveal Solution Discussion Select an answer first