312-85 Intelligence Reporting And Dissemination — 30 Questions

Question 1

Your organization uses a TIP (Threat Intelligence Platform) to ingest STIX feeds. You notice that the ingest process is failing specifically for feeds sourced from an older platform using STIX 1.2. Why is this occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The TIP requires a schema transformation for STIX 1.x to 2.x. STIX 1.x used an XML-based schema with a fundamentally different data model than STIX 2.x, which is JSON-based and restructured around SDOs and SROs. A TIP built for STIX 2.x cannot natively parse STIX 1.2 XML, so a schema transformation (often via tools like stix2-elevator or custom XSLT) is required before ingestion. This is why the ingest fails specifically for the older feed.

Answer

The feed is missing the mandatory TAXII headers

Answer

The feed contains invalid XML tags

Answer

STIX 1.2 does not support JSON format

Question 2

You are configuring a TAXII 2.1 server to share threat indicators with a government partner. You need to ensure the connection enforces the transport-level security requirements for sensitive data exchange. Which setting must you verify in the TAXII configuration?

Accepted Answer

Enable mutual TLS (mTLS) authentication for the client-server connection. TAXII 2.1 mandates HTTPS for transport security, and for sensitive government sharing, mutual TLS (mTLS) is the setting that enforces strong client-server authentication at the transport layer. mTLS requires both the server and client to present valid certificates, ensuring that only authorized partners can connect and that data is exchanged over an authenticated, encrypted channel.

Answer

Configure the TAXII discovery root to use port 443 only

Answer

Disable the API Root discovery service to prevent unauthorized enumeration

Answer

Set the Content-Encoding header to GZIP for all payloads

Question 3

When setting up a TAXII 2.1 client, which THREE settings are mandatory for establishing a successful connection to a server?

Accepted Answer

Server Discovery URL. Option B (Server Discovery URL) is mandatory because a TAXII 2.1 client must first query the discovery endpoint (typically /taxii2/) to learn the server's available API roots and advertised versions before any collection can be accessed. Option C (API Root Identifier) is required because all TAXII 2.1 collection and object endpoints are scoped under an API root path (e.g., /api1/), so the client must know which API root to target for subsequent requests. Option D (Authentication Credentials) is required because TAXII 2.1 servers enforce authentication (commonly HTTP Basic or a bearer token) on discovery, API root, and collection endpoints, so the client cannot establish a successful session without valid credentials. Option A (Local proxy configuration) is not mandatory—a proxy is only needed in environments that route traffic through one, and it is not part of the TAXII protocol requirements. Option E (JSON Schema Validation path) is not mandatory—schema validation is an optional client-side data-quality step and is not needed to connect to or retrieve data from a TAXII 2.1 server.

Answer

Local proxy configuration

Answer

JSON Schema Validation path

Question 4

Which THREE of the following are valid reasons to use the STIX 'Sighting' object?

Accepted Answer

To indicate the source of the observation. The Sighting object is used to indicate that an indicator was seen, provide context on the target, and show where it was detected.

Answer

To define the threat actor profile

Answer

To provide the remediation steps

Question 5

Your organization is mandated to share threat indicators under the Traffic Light Protocol (TLP). Which TLP marking indicates that the information can be shared with peers within the sector but should not be distributed publicly?

Accepted Answer

TLP:GREEN. TLP:AMBER indicates information that can be shared within the organization and with partners/peers who have a need-to-know, but not released to the general public.

Answer

TLP:CLEAR

Answer

TLP:AMBER

Answer

TLP:RED

Question 6

You are drafting a STIX 2.1 'Observed-Data' object to report an IP address involved in a recent exfiltration event. To maintain standard compliance for automated ingestion, which property is mandatory to define the temporal scope of the observation?

Accepted Answer

'first_observed'. In STIX 2.1, the 'Observed-Data' SDO (observed-data) requires both 'first_observed' and 'last_observed' as mandatory timestamp properties to define the temporal scope of when the data was observed. 'first_observed' is the required property that anchors the beginning of the observation window, and it must be a valid RFC 3339 timestamp. Without it, the object fails STIX 2.1 schema validation and cannot be ingested by compliant TAXII clients or TIPs.

Answer

'confidence'

Answer

'created_by_ref'

Answer

'object_marking_refs'

Question 7

You are integrating a new threat intelligence platform (TIP). You need to define a 'Custom Object' in STIX 2.1 to track a specific internal project codename associated with threat actors. Which prefix must be used for the custom object name to ensure compatibility and avoid collisions?

Accepted Answer

'x-'. In STIX 2.1, custom objects must be prefixed with 'x-' to identify them as non-standard extensions to the schema.

Answer

'ext-'

Answer

'c-'

Answer

'internal-'

Question 8

You are auditing your TAXII server configuration for data sharing compliance. Which TWO of the following items must be explicitly defined for each collection to ensure correct data governance and access control?

Accepted Answer

Access Control Lists (ACLs). Option C (Access Control Lists) is correct because TAXII collections require explicit ACLs to define which users or groups may read or write to a given collection, which is essential for enforcing data governance and access control. Option E (Content filtering criteria) is correct because each collection must specify what content is allowed or shared, such as STIX object types or indicator patterns, to ensure the collection only distributes data that complies with sharing agreements and governance rules. Option A (Database indexing strategy) is an implementation performance concern, not a required per-collection governance definition. Option B (Default STIX versioning) is not a mandatory per-collection governance setting, since STIX version negotiation is handled by the protocol and media type. Option D (Server uptime SLA) is an operational service-level concern, not a collection-level access control or governance requirement.

Answer

Database indexing strategy

Answer

Default STIX versioning

Answer

Server uptime SLA

Question 9

You are preparing a threat intelligence report to be shared with a partner organization under the Traffic Light Protocol (TLP). The report includes indicators of compromise and contextual analysis. Which two actions should you take to ensure proper dissemination and handling? (Choose two.)

Accepted Answer

Include a clear handling instruction in the report, such as 'TLP:AMBER - limited disclosure, restricted to participants' organizations'.. The correct actions are to apply the highest sensitivity TLP marking and include explicit handling instructions. This ensures the report is protected according to its most sensitive content and that recipients understand the sharing constraints. These steps are essential for proper dissemination and maintaining trust with partners under TLP.

Answer

Mark the report as TLP:WHITE to ensure it can be shared widely without restriction.

Answer

Omit the TLP marking to avoid confusion, and instead rely on a confidentiality agreement with the partner.

Answer

Use TLP:GREEN because the information is not highly sensitive and can be shared within the community.

Question 10

An analyst is preparing a threat intelligence report for the CISO that includes a detailed technical analysis of a new malware variant. The report contains specific IOCs and TTPs, and the organization wants to share it with a trusted partner under TLP:AMBER. However, the partner is a commercial entity, not a government agency. Which dissemination method is most appropriate to ensure compliance with TLP:AMBER?

Accepted Answer

Share the report via a secure file transfer protocol (SFTP) with encryption, ensuring the partner understands the TLP:AMBER restrictions.. TLP:AMBER permits sharing within the recipient's organization and with trusted partners who need to know, but not public release. Secure transmission via SFTP with encryption and explicit TLP notification ensures the partner is aware of handling requirements. Public posting or insecure email methods fail to meet the protocol's restrictions, while TAXII is better suited for automated indicator exchange, not detailed reports.

Answer

Post the report on a public threat intelligence platform with a TLP:AMBER marking, assuming the platform's access controls are sufficient.

Answer

Share the report via a TAXII server configured with TLP:AMBER markings, allowing the partner to pull the data.

Answer

Email the report as a password-protected PDF to the partner, with the password sent in a separate email.

Question 11

You are a CTI analyst at a healthcare organization. You have received a threat intelligence report from a trusted partner. The report is marked TLP:AMBER. According to the Traffic Light Protocol, how should you handle this information?

Accepted Answer

You may share the information only within your organization and with your clients, but not publicly.. TLP:AMBER permits sharing within the recipient's organization and with clients, but not publicly. This balances the need for action with source protection. Other options misstate the permissions: public sharing is TLP:WHITE, strict individual sharing is TLP:RED, and community-wide sharing is TLP:GREEN.

Answer

You may share the information freely with anyone, including the public.

Answer

You may share the information only with individuals directly involved in the incident response.

Answer

You may share the information with the entire healthcare community without restriction.

Question 12

You are a threat intelligence analyst preparing to share a report with a partner organization. The report contains information that should only be shared within your two organizations and not with any third parties. Which TLP marking should you apply?

Accepted Answer

TLP:AMBER+STRICT. TLP:AMBER+STRICT is the correct marking because it allows sharing within the recipient's organization but prohibits sharing with clients or third parties. This matches the requirement to share only between the two organizations. TLP:AMBER would permit sharing with clients, which is not desired. TLP:RED is too restrictive, and TLP:GREEN is too permissive. Thus, TLP:AMBER+STRICT ensures the information is protected appropriately.

Answer

TLP:RED

Answer

TLP:GREEN

Answer

TLP:AMBER

Question 13

You are troubleshooting a synchronization issue between two threat intelligence platforms. One platform is configured for TAXII 2.1 and the other is receiving the data but failing to parse the STIX 2.1 bundle. Which diagnostic step is most appropriate?

Accepted Answer

Validate the JSON bundle against the STIX 2.1 schema. When one platform receives a STIX 2.1 bundle but fails to parse it, the most likely cause is a malformed or non-conformant JSON structure. Validating the bundle against the STIX 2.1 JSON schema (B) will reveal missing required properties, incorrect object types, or invalid pattern syntax, which are the typical reasons a parser rejects a bundle even though transport succeeded.

Answer

Restart the TAXII server service

Answer

Check the TLS certificate expiration date

Answer

Check the firewall rules for port 443

Question 14

An analyst is mapping internal incident data to STIX 2.1 objects. You need to link a specific threat actor to the infrastructure they recently utilized. Which object type should you use to link the 'Threat-Actor' object to the 'Infrastructure' object?

Accepted Answer

Relationship. In STIX 2.1, the 'Relationship' object is specifically used to connect two SDOs (Domain Objects) with a defined relationship type such as 'uses'.

Answer

Indicator

Answer

Sighting

Answer

Observed-Data

Question 15

You are drafting an executive threat report and need to adhere to the Traffic Light Protocol (TLP). The report contains sensitive information about an ongoing vulnerability in a zero-day exploit that could cause irreparable damage if leaked. Which TLP color should be applied?

Accepted Answer

TLP:RED. TLP:RED is used for information that cannot be shared outside of the specific recipients, which is appropriate for sensitive zero-day intelligence.

Answer

TLP:GREEN

Answer

TLP:AMBER

Answer

TLP:CLEAR

Question 16

When setting up a TAXII 2.1 Collection in a commercial TIP, you are asked to provide a 'Collection ID'. What is the primary purpose of this identifier?

Accepted Answer

To uniquely identify a specific set of intelligence within an API Root. In TAXII 2.1, a Collection is a logical grouping of CTI objects within an API Root, and the Collection ID is a globally unique identifier (typically a UUID) that allows clients to request, poll, or subscribe to that specific set of intelligence. It is the addressing mechanism used in TAXII endpoint URLs such as /{api-root}/collections/{collection-id}/objects/, so without it a consumer cannot target the exact data feed it needs. It does not perform integrity, retention, or encryption functions — those are handled elsewhere in the STIX/TAXII stack.

Answer

To verify the integrity of the STIX bundle

Answer

To define the retention period for the objects

Answer

To encrypt the data payload during transit

Question 17

You are integrating a new threat intel feed that provides 'Course of Action' (CoA) objects. What is the intended use of this STIX object type in an automated environment?

Accepted Answer

To provide actionable remediation steps to defend against a threat. Course of Action (CoA) objects in STIX are intended to provide actionable remediation steps to defend against a threat. They describe specific measures that can be taken to prevent, mitigate, or respond to an attack, such as applying a patch, blocking a port, or reconfiguring a system. In an automated environment, these can be used to trigger defensive actions or guide incident response.

Answer

To verify the identity of the threat actor

Answer

To map the threat actor's TTPs

Answer

To store forensic artifacts

Question 18

A CISO asks for a report that provides a strategic outlook on the threat landscape for the upcoming quarter. What format is most appropriate for this type of audience?

Accepted Answer

Executive Summary PDF. An Executive Summary PDF is the most appropriate format for a CISO because it provides a high-level, strategic overview of the threat landscape, tailored for decision-makers who need concise, actionable insights rather than raw data. It typically includes trends, risks, and recommendations, aligning with the audience's need for strategic planning. Other formats are too technical or granular for an executive audience.

Answer

Full TAXII object dump

Answer

Raw STIX JSON feed

Answer

CSV list of IOCs

Question 19

An organization wants to contribute intelligence to an ISAC (Information Sharing and Analysis Center). They need to ensure their sharing mechanism supports automated, near-real-time updates. Which standard should they adopt?

Accepted Answer

TAXII 2.1. TAXII 2.1 (Trusted Automated Exchange of Intelligence Information) is the OASIS standard specifically designed for automated, near-real-time exchange of cyber threat intelligence. It defines a RESTful API and a set of services (Collections, Channels, etc.) that allow ISAC members to publish and consume STIX-formatted intelligence programmatically. This enables machine-to-machine sharing without human intervention, which is exactly what the organization needs for near-real-time updates.

Answer

PDF report uploads

Answer

Email distribution lists

Answer

SFTP file drops

Question 20

When preparing a report for a SOC team, which metric is most important to include to prove the intelligence is actionable?

Accepted Answer

Confidence Score. A Confidence Score directly quantifies the reliability and certainty of the intelligence, which is essential for the SOC team to assess whether the intelligence is actionable. It indicates how much trust can be placed in the data, enabling prioritization and response. Without a confidence score, the team cannot effectively determine the risk or the appropriate action, making it the most critical metric for proving actionability.

Answer

The total number of threat actors identified

Answer

The date the report was created

Answer

The TLP level