Automation and Orchestration of Threat Intelligence TIE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A TIP administrator is designing a playbook to automate alert triage. The playbook should enrich each alert's IP address with geolocation and reputation data, then assign a priority based on the reputation score. The team wants to avoid unnecessary enrichment calls for internal IP addresses. What is the most appropriate first step in the playbook?

   • ACreate a separate playbook for internal IPs and a different one for external IPs, with no shared logic
   • BCheck whether the IP address is in the organization's internal address ranges, and only proceed with enrichment if it is not internal
   • CEnrich every IP address with geolocation and reputation data, then filter out internal IPs from the results
   • DAssign priority based on geolocation alone, without using reputation data
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An organization receives a high volume of alerts for potentially malicious domains. The security team wants to automate the triage process: for each alert, the TIP should query an external threat intelligence feed for reputation data, and if the reputation score is above a threshold, the alert should be escalated to a human analyst. If the score is below the threshold, the alert should be closed automatically. What is the best way to design this playbook?

   • AAlways escalate the alert after enrichment, regardless of the reputation score
   • BSkip enrichment and escalate all alerts to a human analyst
   • CAlways close the alert after enrichment, regardless of the reputation score
   • DUse a conditional branch after the enrichment step to either escalate or close the alert
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security team is automating the enrichment of indicators using multiple external threat intelligence feeds. They notice that some feeds are slow to respond, causing the enrichment workflow to time out. They want to ensure that enrichment completes within a reasonable time and does not block other workflows. What is the best practice to address this?

   • ASet timeouts for each enrichment call and configure the playbook to continue with partial results if a feed times out
   • BIncrease the timeout values to allow feeds more time to respond
   • CRun enrichment synchronously and wait for all feeds to respond
   • DRemove slow feeds from the enrichment process entirely
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company uses a TIP to manage indicators of compromise (IOCs). They want to automatically revoke indicators that have not been seen in the wild for 90 days and remove them from the firewall block list. What is the best way to implement this?

   • AManually review indicators every 90 days and remove them from the firewall
   • BUse a SIEM rule to expire indicators based on last-seen time
   • CConfigure an automated workflow that expires indicators after 90 days and pushes the removal to the firewall
   • DSet the TIP to automatically delete indicators after 90 days without notifying the firewall
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An organization's TIP automatically enriches every IP address with three external threat feeds. Analysts are overwhelmed by alerts because many IPs are flagged by only one feed with low confidence. The team wants to reduce false positives while still enriching all IPs. What is the best approach?

   • AConfigure the enrichment playbook to require a minimum confidence score or agreement from at least two feeds before generating an alert
   • BIncrease the number of external feeds to get more data, hoping that more feeds will reduce false positives
   • CManually review every IP flagged by any feed before creating an alert
   • DStop enriching IP addresses from external feeds and only enrich internal IPs
   Reveal Solution Discussion Select an answer first