Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst at a mid-sized company manually reviews every phishing alert from the email gateway. The analyst wants to reduce this workload by having the TIP automatically enrich each reported URL with reputation data, and then, only if the URL is confirmed malicious, automatically create a ticket in the ticketing system. The analyst does not want any other automated actions to occur. What should the analyst configure?

   • AA single automation rule that enriches the URL and always creates a ticket
   • BAn orchestration workflow that enriches the URL and also blocks it on the firewall
   • CA playbook that enriches the URL and, based on a condition, creates a ticket
   • DA manual enrichment step followed by a separate manual ticket creation
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is an example of an automated containment action in incident response?

   • ACreating a ticket in the ticketing system.
   • BDocumenting the incident in a report.
   • CSending a notification to the incident response team.
   • DIsolating an infected endpoint from the network.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security team wants to measure the effectiveness of their SOAR playbooks. They have data on playbook execution times, false positive rates, and the number of incidents escalated to human analysts. What is the most meaningful metric to track for continuous improvement?

   • AThe average time to execute a playbook
   • BThe percentage of alerts that were fully automated without human intervention and had a low false positive rate
   • CThe number of integrations configured in the SOAR platform
   • DThe total number of playbook executions per month
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary goal of automating data enrichment in threat intelligence?

   • ATo delete irrelevant indicators from the database.
   • BTo replace the need for external threat intelligence sources.
   • CTo encrypt indicators for secure storage.
   • DTo add contextual information to indicators without manual effort.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which scenario best illustrates orchestration rather than simple automation in a threat intelligence context?

   • AA script that automatically updates firewall rules with newly received indicators of compromise.
   • BA playbook that ingests an alert, enriches the involved indicators, queries a threat intelligence platform, and then opens a ticket if the risk score exceeds a threshold.
   • CA scheduled job that downloads a threat feed and stores it in a database.
   • DA tool that sends an email notification when a new indicator is published.
   Reveal Solution Discussion Select an answer first