200-201 Security Policies and Procedures Practice Question

An organization uses STIX and TAXII to share threat intelligence with an ISAC. What is the purpose of TAXII in this scenario?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It provides a method to transport threat intelligence

TAXII is a protocol for exchanging STIX data.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It stores threat intelligence locally
Why it's wrong here
TAXII is a client-server exchange protocol, not a storage repository; local retention of intelligence is a function of the consuming platform or TIP. It would be correct if the scenario asked where an organisation keeps its own indicators, rather than how it shares them with an ISAC.
✗
It is a platform for malware analysis
Why it's wrong here
TAXII is a transport protocol defining how threat intelligence is exchanged over HTTPS between servers and clients; it performs no malware analysis. It would be the right answer if the question asked how STIX content is transmitted to the ISAC, rather than what analyses the shared data.
✓
It provides a method to transport threat intelligence
Why this is correct
TAXII defines the application-layer protocol and services for exchanging cyber threat intelligence over HTTPS, carrying STIX-formatted content between parties. It satisfies the ISAC sharing requirement by providing the transport mechanism, whereas STIX supplies the structured data format itself.
✗
It defines the format for threat indicators
Why it's wrong here
STIX, not TAXII, defines the structured schema and objects describing threat indicators, observables and relationships. TAXII specifies the API and collection services used to transport that STIX content. Choosing this confuses the data model with the exchange protocol, which is the axis the question tests.

Go deeper