Using Standards and Frameworks to Measure Effectiveness TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization wants to automate the exchange of threat intelligence with a trusted community. They need a protocol that supports push and pull models for sharing STIX data. Which protocol should they use?

   • AMITRE ATT&CK
   • BTAXII
   • CSTIX
   • DCyber Kill Chain
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When structuring a threat intelligence report to describe an adversary's behavior, which framework would be most appropriate to map the specific techniques used during an attack?

   • AMITRE ATT&CK
   • BISO 27001
   • CSTIX
   • DTAXII
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is investigating an incident where an attacker used a known vulnerability in a web application to gain initial access, then escalated privileges using a misconfigured service account, and finally established persistence by creating a new user. The analyst wants to document this in a way that aligns with a standardized framework and can be used to identify similar future attacks. Which approach is most effective?

   • AWrite a narrative report describing the actions in chronological order without using a specific framework.
   • BCreate a STIX report and share it via TAXII with other organizations.
   • CDocument the incident using the Cyber Kill Chain, labeling each action as a phase.
   • DMap each action to the corresponding MITRE ATT&CK techniques and use the mapping to review detection coverage.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security operations center (SOC) has implemented MITRE ATT&CK to map their detections. They have also integrated a threat intelligence feed that provides STIX data. The SOC wants to measure the effectiveness of their detections by tracking how many ATT&CK techniques are covered by their intelligence. However, they are concerned that the intelligence feed may not be aligned with their environment. Which approach would best measure the effectiveness of the intelligence in terms of ATT&CK coverage?

   • ACount the total number of STIX indicators received from the feed.
   • BDeploy a new SIEM to better integrate the intelligence feed.
   • CMap the STIX indicators to ATT&CK techniques and compare the coverage against the techniques observed in their own incident data.
   • DUse the Cyber Kill Chain to measure the phase coverage of the intelligence.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A threat intelligence team is using the Cyber Kill Chain to analyze intrusions. They want to measure the effectiveness of their detection controls at each phase. They have data on the number of intrusions that were detected at each phase. Which metric would best help them identify the weakest phase in their detection?

   • APercentage of intrusions detected at each phase of the Cyber Kill Chain.
   • BAverage time to detect intrusions across all phases.
   • CTotal number of intrusions detected overall.
   • DNumber of STIX indicators used in detections.
   Reveal Solution Discussion Select an answer first