Examkin

Question

Difficulty: MediumThreat Intelligence Sources and Research

A security operations team is configuring an automated threat intelligence pipeline to enrich SIEM alerts and dynamically update perimeter firewall defense rules with real-time indicators of compromise and vulnerability data. Which of the following sources or protocols should the team integrate to achieve structured, machine-readable threat sharing and standardized vulnerability context? (Select TWO.)

  1. TAXII protocol feeds transmitting STIX-formatted threat intelligence data directly to security appliances.Answer
  2. National Vulnerability Database (NVD) CVE data feeds to provide standardized vulnerability scores and metadata.Answer
  3. C
    Manual OSINT web browser queries across public threat researcher blogs during active incident investigations.
  4. D
    Sector-specific ISAC executive email bulletins containing high-level strategic risk advisories.
  5. E
    Dark web hacker forum scraping feeds aimed at profiling threat actor ideological motivations.

Answer

The correct selections are the TAXII protocol feed delivering STIX-formatted threat intelligence and the National Vulnerability Database (NVD) CVE data feed.
Automated security operations require standardized, machine-readable data formats and protocols. TAXII specifically serves as the transport mechanism to push or pull STIX-formatted indicators directly to network security devices like firewalls and SIEMs without manual intervention. Additionally, NVD feeds supply structured CVE and CVSS data, enabling SIEM systems to automatically enrich security event logs with standardized vulnerability context.

Step-by-Step Solution

1
Identify the technical requirements from the scenario.
The scenario requires automated, machine-readable threat sharing for real-time firewall blocklists and SIEM alert enrichment.
Machine-to-machine automation requires standardized transport protocols and structured data formats.
2
Evaluate technical transport and format standards for machine ingestion.
TAXII (Trusted Automated eXchange of Intelligence Information) delivers STIX (Structured Threat Information eXpression) indicators automatically, meeting the requirement for dynamic perimeter blocklists.
STIX/TAXII is the industry standard for machine-readable threat intelligence sharing.
3
Evaluate vulnerability data sources for standardized alert context.
The National Vulnerability Database (NVD) supplies machine-readable Common Vulnerabilities and Exposures (CVE) data and CVSS scores.
NVD feed integration allows security controls to automatically correlate detected assets with standardized vulnerability severity levels.

Key Concept

Machine-readable threat intelligence feeds (STIX/TAXII) and vulnerability repositories (NVD/CVE) enable automated security operations and alert enrichment.
Rate this question

Topics

Threat Intelligence Sources and Research

More questions from this topic