Examkin

Question

Difficulty: HardThreat Intelligence Sources and Research

A Cyber Threat Intelligence (CTI) analyst is designing an integrated threat research and ingestion framework for an enterprise Security Operations Center (SOC). Match each threat intelligence source or transport mechanism on the left with the operational workflow requirement it directly fulfills on the right.

  • TAXII (Trusted Automated eXchange of Intelligence Information) Transport ProtocolAutomating machine-to-machine relay of structured threat indicators (such as STIX packages) directly into firewalls and SIEM tools in real time.
  • National Vulnerability Database (NVD) & CVE DictionaryCross-referencing standardized flaw identifiers against internal software inventories to prioritize security patch deployment using CVSS metrics.
  • Sector-Specific ISAC (Information Sharing and Analysis Center)Exchanging anonymized, industry-specific attack telemetry and emerging threat actor tactics directly among peer organizations in the same sector.
  • Strategic Vendor Intelligence Whitepapers & Academic ResearchAnalyzing long-term geopolitical adversary motivations, overall campaign trends, and macro-level risk to inform executive leadership decision-making.

Answer

TAXII Transport Protocol maps to automated machine-to-machine STIX relay into SIEM/firewalls. NVD & CVE Dictionary maps to cross-referencing standardized vulnerability IDs against internal inventory for patch prioritization. Sector-Specific ISAC maps to exchanging anonymized industry-specific telemetry among peer organizations. Strategic Vendor Whitepapers map to long-term analysis of adversary geopolitical motivations for executive leadership.
Each threat intelligence source or protocol mechanism targets a distinct operational layer within the enterprise security lifecycle: TAXII automates technical indicator ingestion over the network, NVD/CVE standardizes vulnerability severity tracking, ISACs facilitate trusted peer-to-peer industry collaboration, and Strategic Reports deliver high-level geopolitical and trend analysis to corporate executives.

Step-by-Step Solution

1
Identify the automated transport mechanism for structured technical indicators.
TAXII provides the RESTful API / HTTPS transport protocol layer for machine-to-machine exchange of STIX threat intelligence feeds.
Technical IOC ingestion requires automated machine-readable transport protocols rather than human-oriented reports.
2
Identify the repository used for standardized software vulnerability scoring.
NVD and CVE store public vulnerability disclosures and CVSS scores used in patch management.
Vulnerability research relies on standardized identifier schemes to match enterprise inventory against published flaws.
3
Identify the collaborative framework for peer-to-peer industry information sharing.
ISACs provide sector-focused threat sharing communities for trust-based exchange among industry peers.
Organizations benefit from early warnings shared by peer entities operating in the same vertical market.
4
Identify the intelligence tier focused on long-term executive planning and threat actor motivation.
Strategic intelligence reports synthesize high-level adversary trends and risk impacts for leadership decision-makers.
Strategic CTI is tailored for high-level governance and policy decisions rather than tactical operational rule updates.

Key Concept

Threat Intelligence Sources, Formats, and Transport Protocols
Rate this question

Topics

Threat Intelligence Sources and Research

More questions from this topic