Integrating TIPs into Existing Cybersecurity Infrastructure TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is integrating a TIP with a custom in-house tool that does not support STIX/TAXII. The tool has a REST API. The team wants to share indicators bidirectionally. What is the best way to achieve this integration?

   • AUse TAXII and hope the tool can parse it.
   • BManually export and import data between the TIP and the tool.
   • CUse the REST API to push and pull indicators, and map the data format to the tool's schema.
   • DForce the tool to support STIX by installing a plugin.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is deploying a TIP and wants to ensure that indicators from their existing SIEM can be automatically enriched and then sent to their firewall for blocking. They have limited staff and want to minimize manual steps. What should they configure first?

   • AA SIEM-to-TIP integration using an API, then a TIP-to-firewall integration using STIX/TAXII
   • BA manual CSV export from the SIEM to the TIP and then to the firewall
   • CA firewall-to-SIEM direct integration, bypassing the TIP
   • DA TIP-to-SIEM integration only, leaving firewall updates manual
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of using an API to integrate a TIP with a firewall?

   • ATo allow the firewall to send all traffic logs to the TIP for storage
   • BTo replace the firewall's logging system
   • CTo configure the firewall's routing table
   • DTo automatically update firewall blocklists with threat indicators from the TIP
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A TIP integration has been running for several months. The security team wants to ensure that the integration remains effective over time. What should be part of the ongoing maintenance plan?

   • ARegularly review and update integration configurations, monitor data quality, and test failover procedures.
   • BOnly update the TIP software when a major version is released.
   • CSet the integration and forget it, as long as no errors occur.
   • DReplace the TIP with a new platform every year.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an incident, the IR team needs to know if any of the indicators in the TIP are related to the current attack. They want to quickly pivot from a suspicious domain to related indicators. What TIP capability should they use?

   • AManually search each indicator in the TIP one by one
   • BUse the firewall to check if the domain is blocked
   • CUse the TIP's pivot and graph analysis features to explore relationships between indicators
   • DAsk the SIEM to correlate the indicators with the incident
   Reveal Solution Discussion Select an answer first