Intelligence Reporting And Dissemination practice questions

The feed is missing the mandatory TAXII headers

Why it fails: STIX versioning is a schema issue, not a transport protocol header issue.

The feed contains invalid XML tags

Why it fails: STIX 1.2 is XML-based but the error reported is related to ingest, which is a schema mismatch.

STIX 1.2 does not support JSON format

Why it fails: STIX 1.2 supports JSON, but the structure is entirely different.

Configure the TAXII discovery root to use port 443 only

Why it fails: While port 443 is standard, port configuration does not replace the security requirement of the protocol version.

Disable the API Root discovery service to prevent unauthorized enumeration

Why it fails: Disabling discovery prevents authorized partners from finding the collections.

Set the Content-Encoding header to GZIP for all payloads

Why it fails: This is a performance optimization, not a security requirement.

Local proxy configuration

Why it fails: Proxy settings are optional and only needed when traffic must traverse an intermediary; TAXII 2.1 discovery requires server URL, API root and authentication credentials. It is tempting because proxies are common in enterprise egress paths, but a direct connection needs none of them.

JSON Schema Validation path

Why it fails: JSON Schema validation is an optional client-side convenience for validating received STIX content, not a connection parameter. TAXII 2.1 discovery requires the server's API root URL, the collection ID, and valid authentication credentials. Schema validation would matter when building a parser, but omitting it still allows a successful HTTP connection.

To define the threat actor profile

Why it fails: Threat actor profile is a Threat-Actor object.

To provide the remediation steps

Why it fails: Remediation is a Course-of-Action object.

TLP:CLEAR

Why it fails: TLP:CLEAR allows for unlimited, public disclosure.

TLP:AMBER

Why it fails: TLP:AMBER is designed for restricted sharing within a community or sector.

TLP:RED

Why it fails: TLP:RED is restricted to the recipients only, with no further dissemination.

'confidence'

Why it fails: 'confidence' conveys the producer's certainty in the assertion, not when the observation occurred. The mandatory temporal property is 'first_observed', paired with 'last_observed' and 'number_observed'. Confidence is optional and would be the right field when expressing analytical judgement about attribution or accuracy, not temporal scope.

'created_by_ref'

Why it fails: This is optional metadata for attribution.

'object_marking_refs'

Why it fails: These are used for TLP or license handling, not mandatory for basic object definition.

'ext-'

Why it fails: The 'ext-' prefix is reserved for extension-definition objects in STIX 2.1, not custom object type names, so it fails to register the codename object correctly. It is tempting because extensions do use 'ext-', but custom objects require the 'x-' prefix to avoid collisions with standard types.

'c-'

Why it fails: 'c-' is not a valid STIX 2.1 prefix for custom objects; only 'x-' designates custom object types, so a 'c-' name would be rejected or collide. It is tempting as shorthand for 'custom', but the specification mandates 'x-' for user-defined STIX objects.

'internal-'

Why it fails: 'internal-' is not a recognised STIX 2.1 prefix; custom object types must begin with 'x-', so this name breaks interoperability. It is tempting because it describes the object's scope, but STIX reserves 'x-' specifically to guarantee collision-free custom type names.

Database indexing strategy

Why it fails: Indexing strategy is a database performance concern and has no bearing on TAXII collection governance. It is tempting because collections store large volumes of STIX objects where query speed matters, but that is a tuning decision; TAXII collections instead require defined access control and sharing permissions.

Default STIX versioning

Why it fails: STIX versioning governs object serialisation within shared content, not who may read or write a TAXII collection. Collections require explicit read and write permissions to enforce access control. Default STIX versioning would matter when configuring content negotiation between producers and consumers, not governance.

Server uptime SLA

Why it fails: SLA is a service metric, not a data governance configuration.

Mark the report as TLP:WHITE to ensure it can be shared widely without restriction.

Why it fails: TLP:WHITE is for information that can be shared without restriction, but this report contains sensitive indicators and contextual analysis that likely require limited sharing. Using TLP:WHITE would violate the sensitivity of the content and could lead to unintended disclosure. The marking must reflect the actual sensitivity, not an arbitrary desire for wide distribution.

Omit the TLP marking to avoid confusion, and instead rely on a confidentiality agreement with the partner.

Why it fails: Omitting the TLP marking is poor practice; TLP provides a standardized, immediate visual cue for handling. Relying solely on a legal agreement does not replace the need for clear, consistent marking. Without TLP, recipients may mishandle the information, especially if the agreement is not readily accessible or understood by all handlers.

Use TLP:GREEN because the information is not highly sensitive and can be shared within the community.

Why it fails: TLP:GREEN allows sharing within the community, but it does not restrict sharing to specific organizations. If the report contains sensitive indicators meant only for a partner, TLP:GREEN would be too permissive. The marking should match the intended audience; if it's for a specific partner, TLP:AMBER is more appropriate. TLP:GREEN is for broader community sharing.

Post the report on a public threat intelligence platform with a TLP:AMBER marking, assuming the platform's access controls are sufficient.

Why it fails: Posting on a public platform violates TLP:AMBER, which prohibits public dissemination. Even with access controls, public platforms are not considered trusted environments for TLP:AMBER. This could lead to unauthorized exposure, breaching the protocol and potentially damaging trust with the source.

Share the report via a TAXII server configured with TLP:AMBER markings, allowing the partner to pull the data.

Why it fails: TAXII is designed for automated indicator sharing, not for detailed reports. TLP:AMBER requires that the recipient understands handling restrictions; TAXII may not convey this context. Additionally, TAXII servers might be accessible to broader audiences unless strictly configured, risking non-compliance with TLP:AMBER.

Email the report as a password-protected PDF to the partner, with the password sent in a separate email.

Why it fails: While password protection adds security, emailing the password separately is insecure and does not guarantee TLP:AMBER compliance. Email is often not considered sufficiently secure for sensitive threat intelligence, and the method lacks explicit acknowledgment of TLP restrictions by the partner, increasing risk of unintended disclosure.

You may share the information freely with anyone, including the public.

Why it fails: TLP:AMBER does not permit public sharing. It restricts dissemination to the recipient's organization and its clients. Sharing publicly would violate the TLP marking and could damage trust with the partner. TLP:WHITE is the only marking that allows public release. Thus, this action is inappropriate and breaches the handling protocol.

You may share the information only with individuals directly involved in the incident response.

Why it fails: This describes TLP:RED, which is more restrictive than TLP:AMBER. TLP:RED limits sharing to specific individuals, often face-to-face. TLP:AMBER is broader, allowing sharing within the organization and with clients. Applying TLP:RED restrictions to TLP:AMBER information would unnecessarily hinder collaboration and is not required by the marking.

You may share the information with the entire healthcare community without restriction.

Why it fails: TLP:GREEN allows sharing within the community, but TLP:AMBER does not. TLP:AMBER restricts sharing to the organization and its clients. Sharing with the entire healthcare community would exceed the permitted scope and violate the TLP marking. This could lead to unintended exposure and loss of trust with the sharing partner.

TLP:RED

Why it fails: TLP:RED is the most restrictive marking, intended only for the individual recipient and not for sharing within their organization. In this scenario, the information should be shared within both organizations, so TLP:RED is too restrictive. Using it would prevent the partner from sharing with colleagues who need the information, hindering collaboration.

TLP:GREEN

Why it fails: TLP:GREEN permits sharing within the community, not restricted to two organizations. It is broader than needed and could allow the partner to share with other peers, which violates the requirement. TLP:GREEN is suitable for information that can be shared across a sector or group, but here the sensitivity demands a more restrictive marking.

TLP:AMBER

Why it fails: TLP:AMBER allows sharing within the recipient's organization and with clients, but not publicly. It does not restrict sharing to only two organizations; it permits wider distribution within the recipient's organization. The scenario specifically requires sharing only between two organizations, so TLP:AMBER is too permissive. It could lead to unintended disclosure beyond the intended parties.

Restart the TAXII server service

Why it fails: Restarting the TAXII server cannot fix a STIX 2.1 parsing failure, since the bundle content, not the transport service, causes the error. It is tempting because restarts clear transient TAXII connection faults, and would be correct if the server were unreachable rather than delivering unparseable content.

Check the TLS certificate expiration date

Why it fails: TLS certificate expiry would abort the HTTPS connection to the TAXII server entirely, producing handshake failures rather than a received bundle that fails STIX parsing. Certificate checks are the right diagnostic when transport cannot be established, not when payload content is delivered but rejected as malformed.

Check the firewall rules for port 443

Why it fails: Port 443 blocking would prevent the TAXII collection from being retrieved at all, so no bundle would arrive to parse. Firewall rule checks suit connectivity failures — timeouts, refused connections or empty polls — whereas a bundle that arrives and fails parsing points to STIX schema or version mismatch.

Indicator

Why it fails: An Indicator expresses observable patterns with a detection context, not a relationship between a named actor and infrastructure. It is tempting because indicators often reference infrastructure, but STIX 2.1 models actor-to-infrastructure usage through a relationship object, which is what the scenario requires.

Sighting

Why it fails: A Sighting asserts that an observable was seen, optionally attributed to an identity, rather than linking a Threat-Actor SDO to an Infrastructure SDO. It is tempting because sightings involve attribution, but the required actor-to-infrastructure association is expressed through a relationship object.

Observed-Data

Why it fails: Observed-Data records raw sightings of cyber observables, not the association between a Threat-Actor and Infrastructure. It is tempting because incident data frequently produces observables, but linking two SDOs requires a relationship object, which is the correct construct here.

TLP:GREEN

Why it fails: TLP:GREEN allows wide sharing within the community, so it cannot contain a zero-day whose leak causes irreparable damage. GREEN is correct for information useful to peers but not for public release, such as sector-wide indicators; this scenario requires the strictest handling.

TLP:AMBER

Why it fails: TLP:AMBER permits sharing within the recipient's organisation and its clients on a need-to-know basis, which widens distribution beyond the named individuals a zero-day of this severity demands. AMBER suits sensitive internal operational material, not information whose leak causes irreparable damage.

TLP:CLEAR

Why it fails: TLP:CLEAR permits unrestricted sharing, so labelling a zero-day vulnerability with it would expose the sensitive detail to anyone. It is tempting because CLEAR suits public, non-sensitive advisories, but TLP:RED is the correct marking where disclosure could cause irreparable damage and distribution must stay within named recipients only.

To verify the integrity of the STIX bundle

Why it fails: Integrity of a STIX bundle is verified through hashing or digital signatures on the bundle itself, not through the Collection ID, which is simply an identifier string for a TAXII channel. It tempts those who assume every identifier doubles as a checksum, but integrity verification is the role of signing mechanisms.

To define the retention period for the objects

Why it fails: Retention is governed by the TIP's data lifecycle or server policy settings, not by the Collection ID, which merely names the channel. It tempts analysts who conflate object metadata with API resource identifiers, yet a Collection ID carries no temporal semantics; retention would be the right control when configuring storage or purge rules.

To encrypt the data payload during transit

Why it fails: Transport encryption is handled by TLS at the HTTPS layer, not by a Collection ID, which is an opaque label identifying a channel within a TAXII 2.1 server. It would be tempting if you confused collection identifiers with cryptographic key material, but encryption keys belong to TLS configuration, not the API resource naming scheme.

To verify the identity of the threat actor

Why it fails: Course of Action objects describe recommended responses to an attack, not actor identity attributes, so they cannot verify who the threat actor is. It is tempting because CoA content often accompanies actor context in feeds, and identity verification would instead use Identity objects or authentication evidence.

To map the threat actor's TTPs

Why it fails: Course of Action objects describe recommended mitigations or responses, not adversary behaviour patterns, so they cannot map TTPs. It is tempting because CoA is often bundled with intrusion-set reporting, and TTP mapping would instead use Attack Pattern objects linked to the actor.

To store forensic artifacts

Why it fails: CoA objects describe recommended responses to detected threats, such as blocking an IP or isolating a host, so automated tooling can act on them. Storing forensic artefacts is the role of Observed Data and related objects. CoA is tempting because response actions do generate artefacts, but its purpose is prescriptive action, not evidence retention.

Full TAXII object dump

Why it fails: A TAXII object dump delivers bulk machine-consumable intelligence collections over a sharing protocol, not a strategic narrative. Tempting because TAXII transports curated threat data between trusted parties, yet executive quarterly outlooks require interpreted prose; TAXII serves automated feed distribution to security tooling.

Raw STIX JSON feed

Why it fails: Raw STIX JSON is machine-readable structured threat intelligence for automated exchange between platforms, not narrative strategic reporting. Tempting because STIX encodes rich adversary context, but a CISO needs prose analysis of trends and risk; STIX suits ingesting feeds into TIPs, not executive briefings.

CSV list of IOCs

Why it fails: A CSV list of IOCs gives atomic, machine-parseable indicators for detection tooling, lacking the contextual analysis a strategic outlook demands. Tempting because IOC lists are quick to circulate and feed blocklists, but a CISO needs interpreted trends and risk, not raw indicators.

PDF report uploads

Why it fails: PDF uploads are a manual, human-mediated transfer, so no automated near-real-time machine-to-machine exchange occurs. They suit one-off advisory distribution, not continuous indicator sharing. The stem's automation requirement demands a structured, machine-readable transport such as STIX over TAXII.

Email distribution lists

Why it fails: Email distribution lists deliver messages to human inboxes, requiring manual forwarding and parsing rather than automated machine-to-machine exchange. They suit informal advisories and notifications, not continuous indicator feeds. The stem's near-real-time automation requirement demands a structured transport such as STIX over TAXII.

SFTP file drops

Why it fails: SFTP drops move files on a scheduled, manual basis with no standardised query or subscription mechanism, so automated near-real-time exchange is absent. SFTP suits bulk transfer of large datasets. The stem's requirement for automated indicator sharing demands a structured transport such as STIX over TAXII.

The total number of threat actors identified

Why it fails: Strategic, but not immediately actionable for an analyst.

The date the report was created

Why it fails: Timeliness is important, but not a measure of actionability.

The TLP level

Why it fails: TLP defines sharing rules, not actionable efficacy.