Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A TIP enrichment playbook queries three external APIs for every indicator. The APIs have different rate limits and sometimes return errors. The team wants to ensure enrichment completes reliably without exceeding rate limits. What is the best practice?

   • AQuery all three APIs simultaneously and ignore any errors
   • BQuery only one API and skip the others if it succeeds
   • CIncrease the timeout for each API call to allow more time for responses
   • DImplement retry logic with exponential backoff and respect each API's rate limit by adding delays or using a queue
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is designing a playbook to automate alert triage. The playbook receives an alert from the SIEM, extracts the involved IP address, enriches it with threat intelligence, and then decides whether to escalate or close the alert. The team wants to ensure that the playbook does not escalate alerts for IP addresses that are internal to the organization. What is the best way to implement this requirement?

   • AAdd a condition that checks if the IP address is in the internal network range before escalation
   • BEnrich the IP address and then always escalate the alert
   • CClose all alerts for IP addresses that are not in the threat intelligence feed
   • DAlways escalate the alert if the IP address is not in the threat intelligence feed
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat intelligence team wants to demonstrate the value of their new SOAR platform to management. They need a monthly report showing how many alerts were triaged automatically, how many indicators were enriched, and the average time saved per alert. What is the most efficient way to produce this report?

   • AAsk each analyst to manually tally their actions and submit a spreadsheet at the end of the month
   • BUse the TIP's threat feed statistics instead of SOAR metrics
   • CExport raw logs from the SOAR platform and manually create a pivot table in Excel
   • DConfigure the SOAR platform to generate a scheduled report from its built-in metrics and dashboards
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations team uses a TIP that automatically enriches every incoming indicator with passive DNS data. They now want to add a workflow that, after enrichment, checks the indicator's risk score and, if it exceeds a threshold, automatically creates a ticket in the ITSM system and blocks the indicator on the firewall. The team wants to reuse the existing enrichment step without rewriting it. What should they implement?

   • AA new orchestration playbook that calls the existing enrichment action, then applies a conditional branch to trigger the ticket creation and firewall block
   • BA manual runbook that instructs analysts to check the risk score and then manually create tickets and firewall blocks
   • CA new automation script that performs enrichment, ticket creation, and firewall blocking sequentially without any branching
   • DA new TIP data source that ingests risk scores directly from the firewall and ITSM system
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary benefit of automating metrics and reporting in threat intelligence operations?

   • AIt automatically fixes all security issues identified in the reports.
   • BIt eliminates the need for any human review of security metrics.
   • CIt replaces the need for a SIEM in log analysis.
   • DIt provides consistent and timely insights into operational effectiveness without manual effort.
   Reveal Solution Discussion Select an answer first