Using Standards and Frameworks to Measure Effectiveness TIE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which framework provides a structured model of the stages an attacker typically progresses through, from initial reconnaissance to achieving objectives?

   • ATAXII
   • BCyber Kill Chain
   • CMITRE ATT&CK
   • DSTIX
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A threat intelligence team is evaluating the effectiveness of their intelligence sharing with external partners. They want to measure whether the shared intelligence led to any actionable outcomes. Which KPI would best capture this?

   • ATime taken to prepare a STIX bundle for sharing.
   • BNumber of TAXII servers deployed.
   • CNumber of shared indicators that were subsequently detected in partner environments.
   • DNumber of intelligence reports shared per month.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat intelligence team is asked to evaluate whether its intelligence program is meeting its stated objectives. The team has defined objectives such as 'reduce the time to detect a new threat' and 'improve the relevance of intelligence reports'. Which approach best evaluates the program against these objectives?

   • ADefine KPIs for each objective and measure them over time.
   • BConduct a one-time survey of all security staff.
   • CUse STIX to standardize all intelligence reports.
   • DAdopt the MITRE ATT&CK framework to map all intelligence products.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A threat intelligence team is implementing a feedback mechanism to improve the quality of their intelligence products. Which action would most effectively close the feedback loop?

   • AConduct quarterly surveys with intelligence consumers to gather satisfaction and usability feedback.
   • BSwitch to a different threat intelligence platform.
   • CIncrease the number of intelligence reports produced each month.
   • DAutomate the distribution of reports to all employees.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A threat intelligence team is trying to measure the effectiveness of its intelligence sharing with external partners. The team shares indicators and receives indicators from partners. The team wants to know if the shared intelligence is actually being used by partners. Which metric would best provide this insight?

   • ANumber of indicators received from partners that were matched against the organization's environment.
   • BNumber of indicators shared per month.
   • CPercentage of shared indicators that partners later reported as having led to a detection.
   • DNumber of partners in the sharing community.
   Reveal Solution Discussion Select an answer first