Match each threat intelligence source to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Publicly available information
Sector-specific sharing community
Structured language for cyber threat intelligence
Protocol for exchanging threat intelligence
Open-source threat intelligence platform
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
OSINT: Threat intelligence from openly available sources such as websites, social media, and government reports.
The correct matches are: OSINT with open-source intelligence, ISAC with sector-specific sharing, TAXII with protocol, STIX with language. Common confusion occurs between TAXII and STIX, and between OSINT and ISAC.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
OSINT: Threat intelligence from openly available sources such as websites, social media, and government reports.
Why this is correct
OSINT is intelligence derived from unclassified, publicly accessible data such as websites, social media feeds, government publications, conference materials, and press releases. Because these sources are open, the information can be freely gathered and analyzed, though it may carry credibility concerns and rarely exposes covert adversary actions. Properly credentialed OSINT provides context for other intelligence, helping analysts validate findings or detect public exposure of internal vulnerabilities.
ISAC: A sector-specific organization that facilitates sharing of threat intelligence among members.
Why this is correct
An ISAC (Information Sharing and Analysis Center) is a trusted, sector-specific community established to collect, analyze, and disseminate threat intelligence among its vetted member organizations, such as those in finance, energy, or healthcare. The organization facilitates two-way sharing of indicators of compromise, attack patterns, and mitigation strategies, often through a private portal and working groups. ISACs help critical infrastructure operators gain early warnings of sector-targeted threats and collaborate on defense without exposing sensitive proprietary data.
TAXII: A standardized protocol for automating the exchange of cyber threat intelligence.
Why this is correct
TAXII (Trusted Automated Exchange of Intelligence Information) is a protocol specification that defines how threat intelligence can be transported and exchanged automatically between systems. It operates through HTTP and supports both a request/response model for on-demand queries and a publish/subscribe model for continuous feeds. As a transport mechanism, TAXII does not dictate what data is shared, only how it is packaged, encrypted, and delivered, making it the pipeline for moving intelligence, not the structure of the intelligence itself.
STIX: A structured language for describing cyber threat intelligence data.
Why this is correct
STIX (Structured Threat Information Expression) is a standardized, machine-readable language used to represent and describe cyber threat intelligence in a consistent format. It uses an object-oriented data model with JSON or XML serialization to capture observables, indicators, campaigns, threat actor behavior, TTPs, vulnerabilities, and courses of action. STIX is semantic and metadata-rich, enabling analysts to express relationships and context so that threat data can be understood uniformly across different organizations and security tools.
OSINT: A sector-specific organization that facilitates sharing of threat intelligence among members.
Why it's wrong here
This statement is incorrect because it defines an ISAC, not OSINT. OSINT is not a membership-based organization and has no sector-specific restrictions; it is simply intelligence collected from openly available public sources like news sites, forums, and government bulletins. While an ISAC may leverage OSINT as part of its information gathering, the defining characteristic of OSINT is the openness of the source, whereas the defining characteristic of an ISAC is its collaborative, sector-aligned organizational role.
ISAC: A standardized protocol for automating the exchange of cyber threat intelligence.
Why it's wrong here
This statement confuses TAXII with ISAC. An ISAC is not a protocol; it is a real-world organization or consortium of member institutions that trust one another and share intelligence. By contrast, TAXII is an automated, standardized transport protocol used to exchange threat data between systems, often within or among such communities. The ISAC governs who shares and why, while TAXII provides the technical how, handling encryption, authentication, and delivery of the intelligence messages.
Go deeper
Learn chapter
Threat Intelligence and Threat Hunting
Key term
STIX
STIX (Structured Threat Information Expression) is a standardized language and serialization format used to represent and share cyber threat intelligence in a consistent, machine-readable way.
Key term
Threat intelligence
Threat intelligence is evidence-based knowledge about existing or emerging cyber threats that helps organizations defend against attacks.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.