Using Standards and Frameworks to Measure Effectiveness TIE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A threat intelligence team has been using MITRE ATT&CK to map its detection coverage. The team has identified that it has good coverage for initial access and execution, but poor coverage for lateral movement and exfiltration. The team must decide how to allocate its limited resources to improve its security posture. Which approach is most effective?

   • ASwitch to the Cyber Kill Chain framework to get a higher-level view of coverage.
   • BInvest in more commercial threat feeds to get more indicators.
   • CMaintain current coverage and increase the frequency of intelligence reports.
   • DFocus on improving detection for lateral movement and exfiltration, as these are the identified gaps.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A threat intelligence team produces daily reports for executives and weekly technical briefs for analysts. The team wants to measure whether its intelligence products are actually improving the organization's security posture. Which metric best aligns with this goal?

   • APercentage of reported indicators that were subsequently observed in the organization's environment.
   • BNumber of analysts who subscribe to the intelligence feed.
   • CNumber of intelligence reports produced per month.
   • DAverage time to produce a report after a major vulnerability is disclosed.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A threat intelligence team has implemented a KPI dashboard that tracks the number of indicators processed, the number of reports produced, and the number of alerts generated. The team's leadership is concerned that these KPIs do not reflect the actual value of the intelligence program. Which additional KPI would best address this concern?

   • AAverage time to produce a report.
   • BNumber of analysts working on intelligence tasks.
   • CNumber of intelligence sources subscribed to.
   • DPercentage of intelligence reports that led to a change in security controls.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A threat intelligence platform (TIP) needs to automatically ingest structured indicators of compromise (IOCs) from a trusted external partner. The partner publishes IOCs in a machine-readable format and expects the TIP to pull updates on a regular schedule. Which combination of standards and protocols should the TIP support to meet this requirement?

   • AMITRE ATT&CK for the IOC format and the Cyber Kill Chain for the exchange protocol.
   • BSTIX for the exchange protocol and TAXII for the IOC format.
   • CSTIX for the IOC format and TAXII for the automated exchange.
   • DCyber Kill Chain for the IOC format and MITRE ATT&CK for the exchange protocol.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A threat intelligence team has been producing weekly reports for six months. The team wants to determine if the reports have contributed to a reduction in the time to detect and respond to incidents. Which metric should the team track to best assess this contribution?

   • ANumber of new indicators added to the blocklist each week.
   • BAverage time to detect (MTTD) and average time to respond (MTTR) over the six-month period.
   • CNumber of analysts who read the reports.
   • DNumber of reports produced each week.
   Reveal Solution Discussion Select an answer first