ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
Your organization's SIEM must automatically consume external threat-intelligence feeds so it can match indicators such as malicious IP addresses and domains against live log data and raise alerts in near-real time. Which mechanism should you deploy to enable secure, machine-to-machine retrieval of these feeds?
Implement the Trusted Automated eXchange of Indicator Information (TAXII) protocol.
Use the Common Vulnerability Scoring System (CVSS) to rate discovered weaknesses.
Adopt the Structured Threat Information eXpression (STIX) format for all incoming data.
Run OWASP Dependency-Check on server images before deployment.
Trusted Automated eXchange of Indicator Information (TAXII) is the open transport protocol designed specifically for the machine-to-machine exchange of cyber-threat intelligence. When integrated with a SIEM, TAXII clients or servers can poll or receive pushed collections of indicators, which the SIEM can immediately normalize and correlate with internal events. STIX provides the data model for describing threat intelligence but does not handle its transport. CVSS is a scoring framework for vulnerabilities, not a feed transport mechanism. OWASP Dependency-Check analyzes software components for known vulnerabilities and is unrelated to ingesting external threat-intelligence feeds.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the TAXII protocol?
Open an interactive chat with Bash
How does STIX differ from TAXII?
Open an interactive chat with Bash
Why is TAXII useful for SIEM systems?
Open an interactive chat with Bash
What is the role of TAXII in cybersecurity?
Open an interactive chat with Bash
How does STIX differ from TAXII?
Open an interactive chat with Bash
Why can’t CVSS or OWASP Dependency-Check be used in place of TAXII?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)