TIP Roles and Features TIE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following best describes the role of a Threat Intelligence Platform (TIP) in an organization?

   • AA firewall that blocks malicious traffic based on threat intelligence
   • BA vulnerability scanner that identifies weaknesses in the network
   • CA system that centralizes threat intelligence from internal and external sources for analysis and sharing
   • DA tool that only stores raw threat data without any analysis capabilities
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is evaluating a TIP and wants to confirm that it can take raw indicators from a CSV file, a STIX/TAXII feed, and a PDF report, then convert them into a single searchable format. Which TIP function is being tested?

   • AEnrichment
   • BNormalization
   • CCorrelation
   • DSharing
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A TIP is ingesting a feed that provides indicators in a non-standard JSON format. The TIP's default parser fails, but the raw data is stored. The team needs to make the indicators searchable without losing any data. What should they do?

   • ACreate a custom parser or transformation rule to normalize the JSON into the TIP's schema
   • BManually enter each indicator into the TIP
   • CStore the raw JSON in a separate database for manual querying
   • DIgnore the feed and rely on other sources
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization wants to share its own threat intelligence with industry peers using a standardized format, while also receiving intelligence from a government CERT. Which TIP feature is essential?

   • ASupport for STIX/TAXII protocols
   • BA built-in vulnerability scanner
   • CA local database for storing indicators
   • DA custom API for internal applications only
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is considering purchasing a TIP. They already have a SIEM, an EDR, and a firewall. Their main goal is to reduce the time analysts spend manually correlating external threat feeds with internal security events. What should the TIP provide to achieve this?

   • AA replacement for the firewall's rule engine
   • BA standalone database for storing all internal logs
   • CA manual process for analysts to upload feed data
   • DAutomated ingestion of external feeds and integration with the SIEM and EDR
   Reveal Solution Discussion Select an answer first