CS0-004 - Security Operations (34% of the exam) - Section 1.4
Explain threat intelligence and threat-hunting concepts.
Describe threat-intelligence sources, indicator sharing, confidence and reliability scoring, and the intelligence lifecycle, and explain how intelligence drives proactive threat hunting. Distinguish intelligence-driven hunting hypotheses from reactive alerting, and recognise the role of tactics, techniques and procedures in framing what to hunt for.
threat intelligence sourcesindicator sharing (STIX/TAXII)confidence and reliability scoringthreat-hunting hypothesestactics, techniques and procedures
Practice question for this objective
lock_openFree sampleSecurity Operationsmedium
In the STIX/TAXII model for cyber threat intelligence sharing, which statement best describes the division of responsibility between the two?
ASTIX defines the transport protocol that moves intelligence, while TAXII is the language that structures the indicators being moved.
BBoth STIX and TAXII are serialisation formats, and an analyst chooses whichever one the feed provider supports for encoding indicators.
CSTIX is the structured language for representing threat intelligence, while TAXII defines the services and protocol for exchanging it over HTTPS.check_circle Correct
DSTIX assigns confidence scores to each indicator, while TAXII validates those scores against the analyst's own reliability rating.
Distinguish STIX as the structured language for threat intelligence from TAXII as the protocol that transports it. STIX provides the object model and serialisation for describing threats, and TAXII provides the request-response services that let producers and consumers share those STIX objects, so the language and the transport are separate concerns.
Why A is wrong: This is tempting because the two are always named together, but it reverses their roles: TAXII is the transport and STIX is the structured language.
Why B is wrong: This is tempting if the pair is treated as interchangeable formats, but only STIX serialises data; TAXII is a delivery protocol, not an encoding.
Why C is correct: Correct: STIX serialises objects such as indicators and threat actors, and TAXII specifies the client-server exchange used to publish and consume those objects.
Why D is wrong: This is tempting because STIX can carry a confidence property, but neither standard performs reliability validation, and scoring is not the defining purpose of either.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CS0-004 bank for this domain.
Discard the indicator entirely, because the lowest reported confidence score of 20 out of 100 governs how far any downstream analysis can be trusted.
errorWhy it is wrong: Tempting because a low score signals weak sourcing, but confidence is aggregated across corroborating sources rather than pinned to the single worst score, so discarding loses a well-supported lead.
STIX encrypts intelligence feeds at rest, while TAXII signs each indicator so recipients can verify authorship before ingesting it.
errorWhy it is wrong: Tempting because both trust and integrity matter in sharing, but neither STIX nor TAXII is fundamentally an encryption or signing scheme; STIX is a representation language and TAXII is a transport protocol.
Immediately block the domain at the firewall and open a confirmed-compromise incident for the three hosts.
errorWhy it is wrong: Tempting because the internal contact looks like a hit, but a confidence of 15 with an F reliability grade is weak sourcing, so declaring confirmed compromise and full blocking on it alone over-reacts to an unvetted indicator.