A cybersecurity consultant is designing an automated threat intelligence enrichment pipeline for an enterprise security team. The architecture requires ingesting open-source, standardized vulnerability data alongside automated, machine-readable threat indicator feeds from external partners over HTTPS. Which of the following sources or protocols should the consultant integrate into the pipeline to achieve these specific goals? (Select TWO.)
- National Vulnerability Database (NVD) feeds to ingest standardized vulnerability scoring and CVE metadataCevap
- TAXII protocol servers to handle automated real-time transport of structured threat indicators over HTTPSCevap
- CCustom web scrapers targeting unindexed dark web marketplaces for zero-day exploit pricing
- DQuarterly executive strategic intelligence reports summarizing high-level threat actor motivations
- EInternal honeypot network sensors configured to capture localized adversary lateral movement
Cevap
The correct selections are the National Vulnerability Database (NVD) feeds and TAXII protocol servers.
The National Vulnerability Database (NVD) provides publicly available, standardized vulnerability information (such as CVE details and CVSS ratings) that can be ingested into automated systems. TAXII (Trusted Automated eXchange of Intelligence Information) is the standardized application protocol used to transport structured cyber threat intelligence (such as STIX formatted feeds) automatically over HTTPS.
Adım Adım Çözüm
Anahtar Kavram
Threat Intelligence Sources and Transportation Protocols