Integrating TIPs into Existing Cybersecurity Infrastructure TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is integrating a TIP with a firewall and a SIEM. The firewall vendor provides a REST API, and the SIEM supports STIX/TAXII. The team wants to push indicators from the TIP to the firewall for blocking and to the SIEM for correlation. What is the best approach?

   • AManually copy indicators from the TIP to the firewall and SIEM.
   • BUse the SIEM's REST API to push indicators to the firewall.
   • CUse the firewall's REST API for indicator blocking and TAXII for SIEM updates.
   • DUse TAXII for both the firewall and the SIEM.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a TIP, what does an automated alerting workflow typically do?

   • AAutomatically patches all vulnerable systems
   • BDeletes all logs older than 30 days
   • CReplaces the need for a SIEM
   • DSends notifications to security analysts when certain indicators or conditions are detected
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC has a TIP integrated with the SIEM and firewall. The team wants to automate blocking of malicious IPs, but the firewall has a rule limit and the security team is concerned about false positives. The TIP supports confidence scores and allowlists. What is the best approach to balance automation and risk?

   • AAutomate blocking only for indicators with high confidence scores and maintain an allowlist to prevent blocking critical assets.
   • BBlock all indicators from external feeds regardless of confidence.
   • CDisable automated blocking and only use manual blocking.
   • DIncrease the firewall rule limit to accommodate all indicators.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a key benefit of integrating a TIP with incident response playbooks?

   • AIt removes the need for incident documentation
   • BIt automatically deletes all evidence related to the incident
   • CIt ensures that all incidents are closed within one hour
   • DIt enables automated enrichment of indicators during an incident investigation
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC wants to automate the response to phishing emails. The TIP is integrated with the email gateway and the SIEM. The team wants to automatically quarantine emails that contain malicious indicators. However, there is a risk of quarantining legitimate emails. What should be configured to balance automation and risk?

   • AUse a combination of indicator confidence and email header analysis to trigger quarantine, with a manual review queue for borderline cases.
   • BQuarantine all emails that contain any indicator from the TIP.
   • CDisable automated quarantine and only alert on phishing emails.
   • DQuarantine only emails from external senders.
   Reveal Solution Discussion Select an answer first