Using Standards and Frameworks to Measure Effectiveness TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A threat intelligence analyst is writing a report about a new malware campaign. The analyst wants to describe the sequence of actions the attacker took, from initial reconnaissance to data exfiltration, in a way that is easy for non-technical executives to understand. Which framework is most appropriate for this narrative?

   • ASTIX, using structured indicators to describe the malware.
   • BMITRE ATT&CK, listing all techniques used in the campaign.
   • CThe Cyber Kill Chain, breaking the attack into its seven phases.
   • DTAXII, to share the report with external partners.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A threat intelligence team is evaluating whether to adopt STIX/TAXII for sharing intelligence with a partner. The partner uses a proprietary format and is not willing to change. The team wants to ensure that the intelligence can be exchanged seamlessly. Which approach best addresses this constraint?

   • AUse a custom API to translate between the proprietary format and STIX/TAXII.
   • BUse the Cyber Kill Chain to standardize the intelligence content.
   • CAbandon STIX/TAXII and use the partner's proprietary format exclusively.
   • DAdopt STIX/TAXII and require the partner to convert to the standard.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A threat intelligence team wants to measure the effectiveness of its intelligence dissemination process. The team sends alerts to different consumer groups (executives, analysts, and incident responders) and wants to know if the right people receive the right information in time to act. Which KPI best measures this aspect?

   • APercentage of alerts acknowledged by the intended recipients within a defined time window.
   • BAverage length of each alert in words.
   • CTotal number of alerts sent per month.
   • DNumber of intelligence sources used to produce each alert.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization is adopting MITRE ATT&CK to improve its threat detection capabilities. The security team wants to identify which ATT&CK techniques are most relevant to their industry and prioritize detection engineering efforts accordingly. Which approach best supports this goal?

   • ACreate a Cyber Kill Chain for each technique.
   • BUse STIX to encode all techniques and share them with partners.
   • CUse ATT&CK Navigator to visualize and compare techniques against industry-specific threat reports.
   • DImplement all ATT&CK techniques in the SIEM to ensure complete coverage.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is using the Cyber Kill Chain to categorize incidents. They notice that many incidents are being categorized at the 'Delivery' stage, but the team's detection controls are mostly focused on 'Command and Control' and 'Actions on Objectives'. The team wants to improve its overall detection posture. Which approach is most effective?

   • AShift detection focus to the later stages where the team already has controls.
   • BUse MITRE ATT&CK to map the specific techniques used at each stage and identify gaps.
   • CStop using the Cyber Kill Chain and rely solely on STIX/TAXII for incident categorization.
   • DAdd more detection controls at the Delivery stage to catch incidents earlier.
   Reveal Solution Discussion Select an answer first