Explain threat intelligence and threat-hunting concepts

Explain threat intelligence and threat-hunting concepts.

Describe threat-intelligence sources, indicator sharing, confidence and reliability scoring, and the intelligence lifecycle, and explain how intelligence drives proactive threat hunting. Distinguish intelligence-driven hunting hypotheses from reactive alerting, and recognise the role of tactics, techniques and procedures in framing what to hunt for.

threat intelligence sourcesindicator sharing (STIX/TAXII)confidence and reliability scoringthreat-hunting hypothesestactics, techniques and procedures

Practice question for this objective

Free sampleSecurity Operationsmedium

In the STIX/TAXII model for cyber threat intelligence sharing, which statement best describes the division of responsibility between the two?

ASTIX defines the transport protocol that moves intelligence, while TAXII is the language that structures the indicators being moved.
BBoth STIX and TAXII are serialisation formats, and an analyst chooses whichever one the feed provider supports for encoding indicators.
CSTIX is the structured language for representing threat intelligence, while TAXII defines the services and protocol for exchanging it over HTTPS. Correct
DSTIX assigns confidence scores to each indicator, while TAXII validates those scores against the analyst's own reliability rating.

Distinguish STIX as the structured language for threat intelligence from TAXII as the protocol that transports it. STIX provides the object model and serialisation for describing threats, and TAXII provides the request-response services that let producers and consumers share those STIX objects, so the language and the transport are separate concerns.

Why A is wrong: This is tempting because the two are always named together, but it reverses their roles: TAXII is the transport and STIX is the structured language.

Why B is wrong: This is tempting if the pair is treated as interchangeable formats, but only STIX serialises data; TAXII is a delivery protocol, not an encoding.

Why C is correct: Correct: STIX serialises objects such as indicators and threat actors, and TAXII specifies the client-server exchange used to publish and consume those objects.

Why D is wrong: This is tempting because STIX can carry a confidence property, but neither standard performs reliability validation, and scoring is not the defining purpose of either.

See more CS0-004 practice questions, answers explained.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.

Explain threat intelligence and threat-hunting concepts.

Practice question for this objective

More in this domain