Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise has a SOAR platform and a TIP. They want to automate the response to phishing emails: extract indicators, enrich them, and if the indicators are malicious, block the sender and quarantine the email. The team is debating whether to implement this as a single automation rule or as an orchestrated playbook. What is the key advantage of using an orchestrated playbook over a single automation rule?

   • AIt eliminates the need for human oversight
   • BIt guarantees that no false positives will occur
   • CIt allows the workflow to be broken into discrete steps that can be modified, reused, and monitored independently
   • DIt runs faster than a single automation rule
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization has a TIP that identifies malicious domains. They want to automatically block these domains on their DNS server and also notify the security team. The DNS server has an API, and the TIP supports webhooks. What is the most reliable way to implement this integration?

   • AUse the SIEM to detect the domains and block them on the DNS server
   • BUse the TIP's webhook to trigger a script that calls the DNS API and sends a notification
   • CHave the DNS server poll the TIP for new indicators every minute
   • DManually update the DNS block list and send notifications
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A playbook is designed to automatically quarantine a workstation when a high-confidence malware alert is received from the EDR. The team is concerned about false positives that could lock out legitimate users. What should the playbook include to reduce this risk?

   • AA step that immediately quarantines the workstation and then sends an email to the user
   • BA step that quarantines the workstation only if the user is not an executive
   • CA step that waits for a human analyst to approve every quarantine action
   • DA condition that requires the alert to be confirmed by at least two independent detection sources before quarantine
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During an active incident, a security analyst needs to quickly gather evidence from multiple sources: the SIEM, the EDR, and the firewall logs. The analyst also needs to isolate the affected host. The organization has a SOAR platform integrated with these tools. What is the most efficient way to perform these actions?

   • AManually query each tool and then isolate the host
   • BUse the SIEM to collect evidence and the EDR to isolate the host
   • CUse the TIP to collect evidence and isolate the host
   • DUse a SOAR playbook that automatically collects evidence from all sources and isolates the host
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During an active incident, a SOAR playbook automatically collects memory dumps from affected endpoints and then isolates those endpoints from the network. The playbook is triggered by a high-severity alert from the SIEM. What is the primary benefit of this orchestration?

   • AIt guarantees that no evidence is lost during the incident
   • BIt reduces response time by performing evidence collection and containment in a coordinated, automated sequence
   • CIt eliminates the need for any human involvement in incident response
   • DIt automatically determines the root cause of the incident
   Reveal Solution Discussion Select an answer first