200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  STIX

  Why this is correct

  STIX (Structured Threat Information Expression) provides a standardised language and serialisation format for structured threat intelligence, covering indicators, campaigns, threat actors and relationships. It satisfies the requirement for a sharing standard that represents structured threat information, unlike transport protocols such as TAXII.

• ✗

  MISP

  Why it's wrong here

  MISP is an open-source threat intelligence sharing platform and data model, not the standardised language and format defining structured threat information. It is tempting because it genuinely stores and shares indicators and events between organisations, which is its purpose, but the question asks for the representation standard, not the platform.

• ✗

  TAXII

  Why it's wrong here

  TAXII is a transport protocol for exchanging threat intelligence over HTTPS; it defines how STIX content is requested and delivered, not the language representing indicators and campaigns. It is tempting because it is paired with STIX in sharing architectures, which is its real role, but it carries no data model itself.

• ✗

  OpenIOC

  Why it's wrong here

  OpenIOC is a proprietary Mandiant indicator format for describing compromise artefacts, not a standardised language for structured threat information such as campaigns. It is tempting because it does encode indicators, which is its genuine purpose, but it lacks the broader STIX object model and standardisation.

Go deeper

Related to this question