CAS-004 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  CyboX

  Why it's wrong here

  CybOX was a standalone observable-expression schema, now largely absorbed into STIX 2.x, so it no longer serves as the primary structured threat-intelligence sharing format. It was used to characterise individual cyber observables such as files or network events.

• ✗

  TAXII

  Why it's wrong here

  TAXII is a transport protocol defining how threat intelligence is exchanged between servers and clients over HTTPS, not a representation format. It is the right choice when the requirement is automated sharing of STIX content between platforms, rather than structuring the indicators themselves.

• ✓

  STIX

  Why this is correct

  STIX (Structured Threat Information Expression) is purpose-built to represent cyber threat intelligence as structured, machine-readable JSON, covering indicators, campaigns, threat actors and relationships. It satisfies the stem's requirement for a standardised, machine-readable sharing format, unlike document-centric or transport protocols such as TAXII, which merely conveys STIX.

• ✗

  OpenIOC

  Why it's wrong here

  OpenIOC is a proprietary Mandiant indicator format for describing host-based compromise artefacts; it is not a standardised, vendor-neutral sharing format and lacks the broad schema coverage of STIX. It would be chosen for internal indicator exchange within Mandiant tooling.

Go deeper

Related to this question