Integrating TIPs into Existing Cybersecurity Infrastructure TIE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which consideration is most important when planning the integration of a TIP into an existing security infrastructure?

   • APurchasing the most expensive TIP on the market
   • BChoosing a TIP that requires minimal analyst training
   • CSelecting a TIP with the most visually appealing dashboard
   • DEnsuring the TIP supports the same data formats and protocols used by existing tools
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is integrating a TIP and wants to ensure that the integration does not overwhelm their SIEM with too many enrichment requests. What should they configure?

   • AA manual approval step for every enrichment request
   • BRate limiting and throttling on the TIP's API requests to the SIEM
   • CA faster network connection between the TIP and SIEM
   • DA larger SIEM storage capacity
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A TIP integration with a SIEM has been working, but the SOC notices that the TIP is not receiving any new indicators from the SIEM. The SIEM logs show that the API calls are failing with a 401 Unauthorized error. What is the most likely cause?

   • AThe TIP's database is full
   • BThe SIEM's time zone is incorrect
   • CThe API key or credentials used by the SIEM to authenticate to the TIP have expired or been revoked
   • DThe firewall is blocking the SIEM's outbound traffic
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A mid-sized company is deploying a TIP. The security team uses a SIEM for alerting and a ticketing system for incident management. The CISO wants the TIP to automatically enrich SIEM alerts with threat context and create a ticket when a high-confidence indicator is involved. The team has limited API development skills. What should be the first step in the integration plan?

   • ADevelop custom APIs for the SIEM and ticketing system to ensure full control over the integration.
   • BReplace the SIEM with the TIP's built-in alerting to simplify the integration.
   • CImmediately configure the ticketing system integration to ensure incident tracking is in place before any other work.
   • DDefine the data flow and required integrations, then start with the SIEM enrichment use case using existing TIP connectors.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An organization wants to ingest threat intelligence from a commercial feed that provides indicators in STIX 2.1 format over TAXII 2.1. Their TIP supports TAXII 2.0 but not 2.1. What should the integration team do to establish connectivity?

   • AAsk the TIP vendor to immediately develop a custom TAXII 2.1 parser
   • BUse a SIEM as an intermediary to convert TAXII 2.1 to 2.0
   • CCheck if the feed provider offers a TAXII 2.0 endpoint or a REST API that the TIP can consume
   • DManually download the feed and upload it to the TIP daily
   Reveal Solution Discussion Select an answer first