Using Standards and Frameworks to Measure Effectiveness TIE Practice Questions (Page 8)

Questions 36–38

1. 36foundation · easy

   What is the primary purpose of feedback mechanisms in a threat intelligence program?

   • ATo ensure all intelligence is shared publicly
   • BTo eliminate the need for metrics and KPIs
   • CTo replace the need for automated threat intelligence platforms
   • DTo continuously improve the quality and relevance of intelligence products
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A threat intelligence team is sharing intelligence with partners using STIX/TAXII. They want to measure the effectiveness of their sharing by tracking whether partners actually use the intelligence. However, they also need to ensure that the intelligence is properly structured to support automated analysis. Which approach best addresses both needs?

   • AAsk partners to manually confirm receipt of each STIX bundle.
   • BUse STIX relationship objects to link indicators to ATT&CK techniques and track how many of those indicators are subsequently detected by partners.
   • CUse the Cyber Kill Chain to structure the intelligence instead of STIX.
   • DOnly track the number of STIX bundles shared per month.
   Reveal Solution Discussion Select an answer first
3. 38application · medium

   A threat intelligence team has implemented a new process to collect feedback from incident responders who use the intelligence reports. The team wants to use this feedback to improve the quality of future reports. Which action best operationalizes this feedback loop?

   • ATrack the number of times each report is downloaded from the internal portal.
   • BConduct a quarterly survey asking responders to rate the relevance and actionability of the reports.
   • CCompare the number of indicators in each report against the number in the previous report.
   • DMeasure the time between report publication and the next scheduled update.
   Reveal Solution Discussion Select an answer first