Integrating TIPs into Existing Cybersecurity Infrastructure TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During an incident, the SOC uses a TIP to enrich indicators and automate responses. The incident response (IR) team wants to ensure that the TIP's automated actions align with their playbooks. What should be done to align the TIP integration with incident response processes?

   • ADisable automated actions and rely solely on manual enrichment.
   • BUse the TIP to replace the IR team's decision-making.
   • CLet the TIP automatically contain all incidents without human review.
   • DMap TIP workflows to the IR playbook steps and define triggers for automated actions based on playbook phases.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During the planning phase of integrating a Threat Intelligence Platform (TIP) into an existing security infrastructure, which step should be performed FIRST?

   • AConfigure the TIP's API connections to the SIEM
   • BDefine the goals and use cases for the TIP
   • CDeploy the TIP in a production environment
   • DTrain analysts on TIP features
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company's TIP is integrated with a SIEM and a firewall. The SIEM is being upgraded to a new version that changes its API. The firewall integration is working fine. The security team wants to ensure the TIP integration remains functional after the SIEM upgrade. What should be done?

   • ATest the TIP-SIEM integration in a staging environment before the upgrade and update the TIP's SIEM connector if needed.
   • BUse the firewall integration as a backup for the SIEM.
   • CUpgrade the SIEM and then fix any issues that arise.
   • DDisable the SIEM integration until the upgrade is complete.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's SOC receives hundreds of alerts daily. The TIP is integrated with the SIEM and the ticketing system. The team wants to reduce alert fatigue by automatically enriching alerts with threat intelligence and only creating tickets for alerts that match high-confidence indicators. What should be configured in the TIP?

   • ASet up a workflow that enriches each alert, scores it based on indicator confidence, and creates a ticket only when the score exceeds a threshold.
   • BCreate a ticket for every alert and let analysts manually enrich them later.
   • CDisable the SIEM alerting and rely solely on the TIP's correlation engine.
   • DConfigure the TIP to block all IP addresses from external feeds automatically.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A TIP integration has been running for several months. The SOC notices that some indicators from a particular feed are no longer being updated, and the firewall is blocking legitimate traffic. What should the team do first?

   • AUninstall and reinstall the TIP
   • BContact the feed provider to demand a refund
   • CCheck the TIP's integration status and logs for the feed to see if the connection is failing
   • DImmediately disable the firewall blocking rule
   Reveal Solution Discussion Select an answer first