CND Practice Question: Incident Detection Response And Threat Prediction
An enterprise threat intelligence team is consuming a new threat feed formatted in STIX 2.1 to ingest indicators of compromise (IoCs) into their TIP (Threat Intelligence Platform). Which core STIX 2.1 domain object is specifically designed to encapsulate observable data such as file hashes, IP addresses, and domain names?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cyber Observable Object (SCO)
In STIX 2.1, the Indicator object defines a pattern that evaluates observables, but the actual atomic observable data (like IPs, file hashes, and URIs) is encapsulated within the STIX Observable object (formerly Indicators in STIX 1.x, but represented via Cyber Observable Objects or SCOs in STIX 2.x). Indicators point to observables to provide context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attack Pattern Object
Why it's wrong here
Attack Pattern objects describe adversary behaviors and techniques based on frameworks like MITRE ATT&CK.
- ✗
Campaign Object
Why it's wrong here
A Campaign object groups multiple malicious incidents and threat activities over a specific timeframe.
- ✗
Threat Actor Object
Why it's wrong here
A Threat Actor object represents individuals or groups posing a threat, not technical observable data.
- ✓
Cyber Observable Object (SCO)
Why this is correct
Cyber Observable Objects (SCOs) in STIX 2.1 represent telemetry and artifacts such as files, IP addresses, and registry keys.
About these practice questions
This CND question is part of Courseiva's 323-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.