Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company's TIP automatically expires indicators after 30 days. However, some indicators are still relevant and should remain active. The security team wants to automatically extend the expiration date for indicators that have been observed in the last 7 days. What is the best way to implement this?

   • ADisable the automatic expiration and manually manage all indicators
   • BCreate a workflow that checks the last-seen date and extends the expiration if the indicator was seen within 7 days
   • CUse the SIEM to extend the expiration date based on its logs
   • DSet all indicators to never expire
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In an automated threat intelligence workflow, what is a 'trigger'?

   • AAn event or condition that initiates the execution of a workflow.
   • BThe final action taken at the end of a workflow.
   • CA tool used to manually start a workflow.
   • DA type of indicator used to detect malicious activity.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In automated indicator lifecycle management, what does 'revocation' typically involve?

   • AArchiving the indicator without any further action.
   • BAdding more context to an indicator to make it more accurate.
   • CCreating a new indicator based on an existing one.
   • DRemoving an indicator from active use and sharing the revocation with integrated systems.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which metric would be most useful for evaluating the effectiveness of an orchestration playbook?

   • AThe version number of the playbook.
   • BThe number of playbooks stored in the system.
   • CThe average time to complete the playbook from trigger to final action.
   • DThe total number of users with access to the playbook.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which type of tool is specifically designed to orchestrate security operations workflows, including incident response and threat intelligence tasks?

   • AVulnerability scanner
   • BSecurity Orchestration, Automation, and Response (SOAR) platform
   • CEmail gateway
   • DNetwork firewall
   Reveal Solution Discussion Select an answer first