CS0-003 Incident Response and Management Practice Question
An organization wants to automate the sharing of threat intelligence with other trusted entities using a standardized protocol. Which protocol is specifically designed for this purpose?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TAXII
TAXII (Trusted Automated eXchange of Indicator Information) is a protocol for exchanging cyber threat intelligence in a standardized format, often used with STIX.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
STIX
Why it's wrong here
Structured Threat Information Expression (STIX) is an XML/JSON-based serialization language used to standardize the representation of cyber threat intelligence (CTI). While it defines the format and schema for describing threat actors, campaigns, and indicators, it does not function as a transport protocol to transmit this data across networks.
- ✓
TAXII
Why this is correct
Trusted Automated Exchange of Intelligence Information (TAXII) is the application-layer protocol specifically designed to route and exchange cyber threat intelligence over HTTPS. It supports multiple sharing models, such as hub-and-spoke or peer-to-peer, enabling organizations to securely automate the ingestion and dissemination of STIX-formatted data.
- ✗
REST API
Why it's wrong here
Representational State Transfer (REST) APIs are architectural styles used for building general-purpose web services, rather than a dedicated protocol for threat intelligence sharing. While TAXII 2.x is implemented as a RESTful API, selecting a generic REST API does not provide the standardized schemas and threat-sharing specifications required out of the box.
- ✗
MISP
Why it's wrong here
Malware Information Sharing Platform (MISP) is an open-source software platform and database used for storing, correlating, and sharing threat indicators. Although MISP facilitates threat intelligence collaboration and can utilize TAXII for transport, it is a complete software application rather than a standardized transport protocol itself.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
STIX
STIX (Structured Threat Information Expression) is a standardized language and serialization format used to represent and share cyber threat intelligence in a consistent, machine-readable way.
Key term
TAXII
TAXII (Trusted Automated eXchange of Indicator Information) is a standardized protocol that enables the automated sharing of cyber threat intelligence (CTI) between organizations and security systems.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.