During an incident response, the team needs to quickly determine if any internal hosts communicated with a set of malicious IP addresses. The TIP is integrated with the SIEM. What is the most effective way to use this integration?

Wait for the TIP to automatically send alerts for any matching traffic

Manually check each host's firewall logs against the IP list

Create a SIEM query that correlates the malicious IPs from the TIP with network connection logs

Use the TIP to block the IPs at the firewall without checking internal hosts

A TIP integration has been in place for a year. The SOC notices that the TIP is receiving duplicate indicators from multiple feeds, causing storage and processing overhead. What is the best way to address this?

Increase the TIP's storage capacity

Configure the TIP's deduplication and normalization features to consolidate duplicate indicators

Manually delete duplicate indicators each week

Disable all but one feed to eliminate duplicates

A TIP has been integrated with multiple data sources and security tools. The security team notices that some indicators are not being updated in the firewall, and the TIP logs show connection errors to the firewall API. What should be the first step to resolve this issue?

Check the firewall API credentials and network connectivity from the TIP to the firewall.

Reinstall the TIP to reset all integrations.

Disable the firewall integration and use manual updates.

Ignore the errors and monitor if the issue resolves itself.

An organization uses a TIP that supports STIX/TAXII for sharing indicators with external partners. They want to share a curated set of indicators with a partner organization. What is the most appropriate way to do this?

Use the SIEM to send the indicators to the partner

Publish the indicators on a public website

Email the indicators as a CSV file to the partner

Create a TAXII collection in the TIP and grant the partner access to that collection

EC-CouncilThreat Intelligence Essentials

Domain 5Objective 4

Integrating TIPs into Existing Cybersecurity Infrastructure TIE Practice Questions (Page 7)

Part of the Threat Intelligence Platforms domain, which makes up ~13% of our current practice bank.

44questions here

9free pages

6concepts

Questions 31–35

31foundation · easy
Which standard protocol is commonly used by TIP APIs to exchange threat intelligence data?
Select an answer first
32application · medium
During an incident response, the team needs to quickly determine if any internal hosts communicated with a set of malicious IP addresses. The TIP is integrated with the SIEM. What is the most effective way to use this integration?
Select an answer first
33expert · hard
A TIP integration has been in place for a year. The SOC notices that the TIP is receiving duplicate indicators from multiple feeds, causing storage and processing overhead. What is the best way to address this?
Select an answer first
34application · medium
A TIP has been integrated with multiple data sources and security tools. The security team notices that some indicators are not being updated in the firewall, and the TIP logs show connection errors to the firewall API. What should be the first step to resolve this issue?
Select an answer first
35application · medium
An organization uses a TIP that supports STIX/TAXII for sharing indicators with external partners. They want to share a curated set of indicators with a partner organization. What is the most appropriate way to do this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.