Integrating TIPs into Existing Cybersecurity Infrastructure TIE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of configuring a connection between a TIP and a SIEM?

   • ATo enable the SIEM to receive threat intelligence for correlation with security events
   • BTo replace the SIEM's log storage with the TIP's database
   • CTo allow the TIP to directly block network traffic
   • DTo provide a backup for the SIEM's configuration
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   During an active incident, the SOC uses the TIP to enrich indicators and automate containment. The IR team has a playbook that requires manual approval before blocking external IPs. However, the TIP is configured to automatically block high-confidence indicators. What should be done to align the TIP with the IR process?

   • AModify the TIP workflow to require manual approval for blocking actions, even for high-confidence indicators.
   • BChange the IR playbook to allow automatic blocking.
   • CDisable the TIP's blocking capability entirely.
   • DAllow the TIP to block automatically to speed up response.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A TIP integration has been in production for a year. The security team notices that the TIP is receiving a large number of indicators from external feeds, but many are outdated or irrelevant. This is causing performance issues and alert fatigue. What should be done to maintain the effectiveness of the integration?

   • AIgnore the issue and continue as is.
   • BIncrease the TIP's processing capacity to handle the volume.
   • CDisable all external feeds to reduce volume.
   • DReview and tune the feed selection and indicator expiration policies in the TIP.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is planning to integrate a TIP into its security infrastructure. The security team has identified several data sources: SIEM, firewall, and external threat feeds. They also have a limited budget and want to minimize disruption. What should be the priority during the integration planning phase?

   • APrioritize integrations based on risk reduction and business impact, and phase the rollout to minimize disruption.
   • BIntegrate all data sources simultaneously to speed up deployment.
   • CStart with the most complex integration to get it out of the way.
   • DSkip the planning phase and configure integrations directly.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company uses a TIP to collect threat intelligence from multiple external feeds. One feed provides indicators in STIX format via TAXII, another provides CSV files via email, and a third provides JSON via a REST API. The team wants to centralize all feeds in the TIP. What should be done?

   • AConfigure the TIP to ingest each feed using its native protocol and normalize the data into a common format.
   • BConvert all feeds to CSV and upload them manually.
   • CAsk the feed providers to all use the same protocol.
   • DUse only the TAXII feed and ignore the others.
   Reveal Solution Discussion Select an answer first