CS0-003 Incident Response and Management Practice Question
A security analyst needs to share threat intelligence with other organizations in a standardized format. Which of the following standards should the analyst use?
⚠ Common exam trap
CS0-004 often tests the confusion between general web protocols (REST, SOAP) and specialized threat intelligence standards, tricking candidates into choosing REST because it's commonly used for APIs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
STIX/TAXII
STIX (Structured Threat Information Expression) is a standardized language for describing cyber threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol for exchanging that intelligence over HTTPS. Together, they provide a standardized format and transport mechanism for sharing threat intel between organizations, as required by the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
REST
Why it's wrong here
Representational State Transfer (REST) is an architectural style used for designing networked applications and APIs, rather than a specific format or protocol for threat intelligence. While threat sharing platforms may expose RESTful APIs to transmit data, REST itself does not define the structured schemas or taxonomies required to represent indicators of compromise (IoCs) or threat actor behaviors.
- ✓
STIX/TAXII
Why this is correct
Structured Threat Information Expression (STIX) is a standardized serialization format used to model and represent structured cyber threat intelligence. Trusted Automated Exchange of Intelligence Information (TAXII) is the application-layer protocol specifically designed to securely route and exchange these STIX-formatted threat feeds over HTTPS, making them the industry standard for automated threat sharing.
- ✗
SOAP
Why it's wrong here
Simple Object Access Protocol (SOAP) is an XML-based messaging protocol specification used for exchanging structured information in the implementation of web services. It lacks the native semantic models, cybersecurity taxonomies, and standardized transport mechanisms required to effectively categorize, correlate, and distribute threat intelligence data across diverse security operations centers.
- ✗
SNMP
Why it's wrong here
Simple Network Management Protocol (SNMP) is a protocol designed specifically for monitoring and managing network devices, such as routers, switches, and firewalls, on an IP network. It relies on Management Information Bases (MIBs) to query device status and receive alerts (traps), making it entirely unsuitable for representing or sharing complex cyber threat intelligence feeds.
Go deeper
Related to this question
Learn chapter
Geolocation Analysis in Threat Hunting
Key term
TAXII
TAXII (Trusted Automated eXchange of Indicator Information) is a standardized protocol that enables the automated sharing of cyber threat intelligence (CTI) between organizations and security systems.
Key term
STIX
STIX (Structured Threat Information Expression) is a standardized language and serialization format used to represent and share cyber threat intelligence in a consistent, machine-readable way.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.