Using Standards and Frameworks to Measure Effectiveness TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations center (SOC) analyst is documenting a newly discovered intrusion campaign. The analyst needs to structure the technical indicators (hashes, IPs, domains) and the relationships between them in a standardized, machine-readable format that can be shared with partner organizations. Which approach best satisfies this requirement?

   • ACreate a PDF report with the indicators and email it to partner organizations.
   • BMap the indicators to MITRE ATT&CK techniques and include them in a slide deck.
   • CPublish the indicators in a STIX 2.1 bundle using TAXII 2.1 for transport.
   • DUpload the indicators to a private GitHub repository and share the link.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A threat intelligence team is evaluating the quality of their intelligence feeds. They want to track whether the indicators they receive are accurate and actionable. Which KPI would best measure the accuracy of the intelligence feeds?

   • ATime to integrate a new indicator into the SIEM.
   • BNumber of indicators ingested per day.
   • CNumber of threat intelligence platforms used.
   • DPercentage of indicators that were confirmed as malicious during investigation.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which standard would you use to ensure that threat intelligence data can be shared automatically between different organizations' security tools?

   • AMITRE ATT&CK
   • BCyber Kill Chain
   • CNIST Cybersecurity Framework
   • DTAXII
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat intelligence team wants to measure the effectiveness of its intelligence collection phase. The team collects data from open-source, commercial, and internal sources. Which KPI would best measure the quality of the collected intelligence?

   • ATime spent on collection activities per week.
   • BNumber of reports generated from the collected intelligence.
   • CNumber of sources used per report.
   • DPercentage of collected intelligence that is later confirmed as accurate by incident investigations.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A threat intelligence team is evaluating the effectiveness of their intelligence feeds. They have noticed that many indicators from a commercial feed are false positives, causing alert fatigue in the SOC. They want to reduce false positives while maintaining good coverage. Which approach would best balance accuracy and coverage?

   • ASwitch to a different commercial feed without evaluating its quality.
   • BDisable the commercial feed entirely to eliminate false positives.
   • CIncrease the alert threshold for all indicators to reduce noise.
   • DImplement a scoring mechanism that weights indicators based on their historical accuracy and context, and automatically deprioritizes low-scoring indicators.
   Reveal Solution Discussion Select an answer first