Using Standards and Frameworks to Measure Effectiveness TIE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which standard is specifically designed to encode and exchange cyber threat intelligence in a structured, machine-readable format?

   • ASTIX
   • BCyber Kill Chain
   • CTAXII
   • DMITRE ATT&CK
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A threat intelligence program wants to measure the timeliness of their intelligence products. Which metric would best assess this?

   • ANumber of threat intelligence platforms integrated.
   • BPercentage of reports that were used by the incident response team.
   • CNumber of intelligence reports published per month.
   • DTime from initial observation of a threat to publication of the intelligence report.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A threat intelligence team is struggling to demonstrate the value of their program to executives. They have data on the number of reports produced, the number of indicators shared, and the number of detections that used their intelligence. However, executives want a single metric that shows the business impact of the intelligence program. Which metric would best demonstrate business impact?

   • ATotal number of intelligence reports produced annually.
   • BNumber of TAXII feeds subscribed to.
   • CReduction in mean time to respond (MTTR) to incidents that were informed by threat intelligence.
   • DPercentage of intelligence reports that were read by analysts.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is evaluating its detection coverage against a known adversary group that uses spear-phishing, PowerShell scripts, and credential dumping. The team wants to identify which of its existing security controls would likely detect these behaviors and which gaps exist. Which framework should the team use to structure this evaluation?

   • AA set of KPIs measuring the number of alerts generated per behavior.
   • BMITRE ATT&CK to map the behaviors to techniques and then compare them with the organization's detection capabilities.
   • CThe Cyber Kill Chain to determine the stage of each behavior.
   • DSTIX to represent the adversary's TTPs and TAXII to share them with partners.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A threat intelligence team is using MITRE ATT&CK to structure their detection coverage. They want to identify which techniques are not currently covered by their SIEM detections. Which ATT&CK resource would they use to visualize this gap?

   • ACyber Kill Chain
   • BSTIX
   • CTAXII
   • DATT&CK Navigator
   Reveal Solution Discussion Select an answer first