Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of automating the expiration of indicators in a Threat Intelligence Platform?

   • ATo increase the storage capacity of the TIP.
   • BTo manually review each indicator before it expires.
   • CTo keep all indicators active indefinitely for maximum protection.
   • DTo remove indicators that are no longer relevant or have lost their validity.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a common challenge when implementing automation and orchestration in threat intelligence?

   • AAutomation completely eliminates the need for security analysts.
   • BHigh rate of false positives from automated enrichment and detection.
   • COrchestration is only applicable to large enterprises.
   • DLack of any available orchestration tools in the market.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company wants to automatically block malicious IP addresses on their perimeter firewall as soon as they are identified by their TIP. The TIP has an API, and the firewall vendor provides an API for updating block lists. What is the most appropriate integration approach?

   • AManually copy indicators from the TIP to the firewall
   • BUse the SIEM to send indicators to the firewall instead of the TIP
   • CConfigure the TIP to push indicators to the firewall via its API
   • DHave the firewall pull indicators from the TIP on a schedule
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a key automation capability commonly found in a Threat Intelligence Platform (TIP)?

   • AManual copy-paste of indicators into a spreadsheet for analysis.
   • BAutomated ingestion of indicators from multiple threat feeds and enrichment with contextual data.
   • CAutomatically patching vulnerabilities on all endpoints without human oversight.
   • DReplacing the need for any human security analyst in the organization.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An organization's TIP automatically shares indicators with a partner organization via a trusted feed. Some indicators are sensitive and should not be shared. The team wants to automate sharing while ensuring sensitive indicators are excluded. What is the best approach?

   • AShare all indicators and rely on the partner to handle them appropriately
   • BDisable sharing entirely to avoid any risk
   • CManually review each indicator before it is shared
   • DTag sensitive indicators with a 'no-share' label and configure the sharing playbook to exclude any indicator with that tag
   Reveal Solution Discussion Select an answer first