Using Standards and Frameworks to Measure Effectiveness TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large enterprise has a mature threat intelligence program that produces STIX bundles and shares them via TAXII. The SOC wants to measure the effectiveness of their intelligence by tracking how many of their own detections were triggered by their intelligence. However, the SOC also wants to ensure that the intelligence is properly mapped to MITRE ATT&CK techniques to identify detection gaps. Which approach best satisfies both objectives?

   • AOnly track the number of STIX bundles shared with partners.
   • BTrack the number of alerts generated by intelligence-derived indicators and map those indicators to ATT&CK techniques using the STIX relationship objects.
   • CMap all intelligence to the Cyber Kill Chain phases and measure the time to detect each phase.
   • DDeploy a new SIEM to better correlate intelligence with detections.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of a Key Performance Indicator (KPI) for a threat intelligence program?

   • AVendor's stock price
   • BNumber of employees in the organization
   • CTime to integrate new threat indicators into detection rules
   • DColor of the threat intelligence dashboard
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A threat intelligence team is considering adopting a framework to standardize its reporting. The team produces both tactical reports for analysts (with detailed IOCs) and strategic reports for executives (with high-level trends). The team wants a single framework that can support both types of reporting. Which framework is best suited for this dual requirement?

   • ACyber Kill Chain, because it is simple and easy to understand.
   • BTAXII, because it supports both collection and sharing of intelligence.
   • CSTIX, because it can represent both indicators and high-level threat actor information.
   • DMITRE ATT&CK, because it provides both technique-level detail and high-level tactics.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is using the Cyber Kill Chain to analyze a recent intrusion. They want to identify where their detection controls failed so they can improve their monitoring. Which phase of the Cyber Kill Chain would they focus on if the attacker successfully established a command-and-control (C2) channel?

   • AExploitation
   • BDelivery
   • CActions on Objectives
   • DCommand and Control
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat intelligence team wants to measure whether their intelligence reports are actually being used by the incident response (IR) team to improve detection and response times. Which metric would most directly measure the effectiveness of the intelligence program?

   • ANumber of threat intelligence platforms (TIPs) deployed.
   • BPercentage of IR investigations that referenced a threat intelligence report.
   • CAverage time to produce a threat intelligence report.
   • DNumber of intelligence reports produced per month.
   Reveal Solution Discussion Select an answer first