Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A TIP automatically blocks an IP address on the firewall for 24 hours after detection. After 24 hours, the block expires, but the TIP still shows the indicator as active. The security team wants the indicator to be automatically revoked from the firewall and marked as expired in the TIP when the block expires. What should be configured?

   • AA condition in the TIP that automatically expires any indicator after 24 hours, but does not touch the firewall
   • BA manual process where analysts remove the firewall block and then change the indicator status
   • CA new data source that ingests firewall logs to detect when the block expires
   • DA playbook triggered by a timer that, after 24 hours, removes the firewall block and updates the indicator status to expired
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A TIP administrator wants to automate the process of ingesting indicators from a new OSINT feed, enriching them with internal asset data, and then publishing them to the organization's firewall blocklist. The TIP supports API-based integrations. What is the most efficient way to set this up?

   • AHave an analyst manually copy indicators from the OSINT feed into the TIP and then into the firewall
   • BWrite a custom script that downloads the feed, enriches it manually, and then uploads it to the firewall
   • CConfigure the TIP's feed connector to ingest the OSINT feed, then create an enrichment playbook that adds internal asset context and a sharing action that pushes indicators to the firewall
   • DUse the SIEM to ingest the OSINT feed and then push indicators to the firewall, bypassing the TIP
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a threat intelligence workflow, what is the primary difference between automation and orchestration?

   • AAutomation is a manual process that is documented, while orchestration is the tool that performs the automation.
   • BAutomation executes a single task without human intervention, while orchestration coordinates multiple automated tasks to achieve a larger workflow.
   • CAutomation requires human approval for each step, while orchestration runs entirely without human involvement.
   • DAutomation is used only for data collection, while orchestration is used for analysis and reporting.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of an external source used for automated indicator enrichment?

   • AThe local file server.
   • BThe organization's internal HR system.
   • CA WHOIS database for domain registration details.
   • DThe organization's email server logs.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does a Threat Intelligence Platform (TIP) typically integrate with a SIEM to enable automated response?

   • AThe SIEM sends raw logs to the TIP for storage, and the TIP performs all analysis.
   • BThe SIEM and TIP are manually updated by analysts with no automated data exchange.
   • CThe TIP sends indicators to the SIEM, which then generates alerts when those indicators are observed in logs.
   • DThe TIP replaces the SIEM entirely, eliminating the need for log monitoring.
   Reveal Solution Discussion Select an answer first