Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of automated indicator sharing in a Threat Intelligence Platform?

   • ATo manually review each indicator before it is used.
   • BTo distribute indicators of compromise to other security tools and partner organizations in a timely manner.
   • CTo store indicators in a private database for future reference only.
   • DTo replace the need for threat intelligence analysts entirely.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the role of a 'condition' in an automated threat intelligence workflow?

   • ATo store the results of the workflow.
   • BTo define the order in which all actions are executed.
   • CTo trigger the workflow at a scheduled time.
   • DTo determine whether certain actions should be executed based on data values.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's TIP detects a malicious domain and automatically sends a block command to the firewall. However, the domain is still resolving on some endpoints because the DNS server caches the record. What additional integration should the TIP use to ensure the domain is blocked effectively?

   • AIntegrate with the DNS server to add the domain to a sinkhole or blocklist, and optionally push a new TTL to clear cached entries
   • BDisable the firewall block because it is ineffective
   • CSend an email to all users instructing them to clear their DNS cache manually
   • DCreate a new indicator in the TIP with the same domain but a different threat type
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations team wants to automate the initial triage of alerts from their SIEM. They want the TIP to enrich indicators, then automatically block malicious IPs on the firewall, and finally open an incident ticket. The team has a SOAR platform and a TIP that both support API integrations. What is the most effective way to implement this workflow?

   • AConfigure the TIP to directly call the firewall and ticketing system APIs without a SOAR platform
   • BUse the SIEM's built-in automation to trigger the firewall block and ticket creation
   • CConfigure the SOAR platform to orchestrate the TIP enrichment, firewall blocking, and ticket creation
   • DManually run the enrichment and blocking steps, then use the SOAR platform only for ticket creation
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   How do orchestration tools typically integrate with a Threat Intelligence Platform (TIP)?

   • AThrough APIs that allow the orchestration tool to query the TIP for indicators and push enrichment results back.
   • BBy requiring analysts to manually copy indicators from the TIP into the orchestration tool.
   • CBy replacing the TIP entirely with the orchestration tool's built-in intelligence database.
   • DBy using the same physical server to run both tools without any software interface.
   Reveal Solution Discussion Select an answer first