Integrating TIPs into Existing Cybersecurity Infrastructure TIE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is integrating a TIP with a SIEM and a firewall. The SIEM supports STIX/TAXII, but the firewall only supports a proprietary API. The team wants to automate the sharing of indicators from the TIP to both systems. What is the most efficient and maintainable approach?

   • AUse TAXII for both, assuming the firewall will support it in the future.
   • BUse TAXII for the SIEM and the firewall's proprietary API for the firewall, with a unified indicator format in the TIP.
   • CDevelop a custom connector for the SIEM to use the firewall's API.
   • DUse the firewall's API for both the SIEM and the firewall.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does aligning TIP integration with incident response processes enhance detection capabilities?

   • ABy eliminating the need for a SIEM
   • BBy automatically resolving all incidents without human involvement
   • CBy replacing the incident response team's procedures
   • DBy providing contextual threat intelligence that helps analysts identify and prioritize incidents
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization's IR team uses a TIP to support incident response. The team wants to ensure that the TIP's automated actions do not interfere with the IR process. What should be done?

   • ADisable all automated actions to avoid interference.
   • BUse the TIP to replace the IR team's decision-making.
   • CAllow the TIP to take any action without oversight.
   • DDefine clear escalation paths and approval workflows for automated actions.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is an operational best practice for maintaining a TIP integration?

   • AAvoiding any changes to the TIP configuration
   • BOnly updating the TIP during major incidents
   • CDisabling all external feeds to reduce noise
   • DRegularly reviewing and updating threat intelligence sources
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses a proprietary SIEM that does not have a prebuilt TIP connector. The TIP provides a REST API. What is the most practical way to integrate the SIEM with the TIP?

   • AReplace the SIEM with one that has a native TIP connector
   • BManually copy indicators between the SIEM and TIP
   • CUse STIX/TAXII to connect the SIEM directly to the TIP
   • DUse the TIP's REST API to build a custom integration that sends and receives indicator data
   Reveal Solution Discussion Select an answer first