Integrating TIPs into Existing Cybersecurity Infrastructure TIE Practice Questions (Page 9)

Questions 41–44

1. 41expert · hard

   A company is integrating a TIP into its security infrastructure. The security team has identified that the SIEM integration is critical for detection, but the firewall integration is critical for prevention. The team has limited resources and must choose one to implement first. The company has a mature detection program but weak prevention. What should be the priority?

   • APrioritize the firewall integration to improve prevention, as detection is already mature.
   • BDelay integration until more resources are available.
   • CPrioritize the SIEM integration to further improve detection.
   • DIntegrate both simultaneously despite limited resources.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An organization is integrating a TIP with multiple security tools using different APIs. They want to ensure that the integration is resilient and can handle API changes from the tools. What is the best practice?

   • AHardcode the API endpoints in the TIP configuration
   • BUse only one API protocol for all integrations
   • CAvoid using APIs and rely on manual data transfers
   • DUse a middleware or integration layer that abstracts the APIs and provides a single point of management
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A SOC wants to automatically enrich every alert that contains a file hash with threat intelligence from their TIP. They also want to automatically create a ticket in their ITSM tool for alerts that are confirmed as malicious. What is the most efficient way to achieve this?

   • AHave the SIEM directly query the TIP for each alert and then manually create tickets
   • BUse the firewall to enrich file hashes and send alerts to the ITSM tool
   • CCreate a daily report of all file-hash alerts and send it to the SOC for review
   • DConfigure a workflow in the TIP that triggers on file-hash alerts, performs enrichment, and then creates an ITSM ticket if the reputation is malicious
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Why is monitoring the TIP integration important for sustained effectiveness?

   • ATo ensure the TIP is never updated
   • BTo replace the need for analyst review
   • CTo increase the number of false positives
   • DTo identify and resolve connectivity issues with data sources
   Reveal Solution Discussion Select an answer first