CCNP Security 350-701 SCOR Practice Test 6

Correct Answer: To provide a standardized, structured language and format for describing and sharing cyber threat information such as indicators, attack patterns, and threat actors
Explanation: STIX is a structured language standard specifically designed for representing and exchanging cyber threat intelligence in a consistent, machine-readable format, unlike the unrelated networking, routing, or addressing concepts listed.

Correct Answer: TAXII (Trusted Automated Exchange of Intelligence Information)
Explanation: TAXII is the transport protocol specifically built to automate the exchange of STIX threat intelligence between parties, unlike SNMP, DHCP, OSPF, STP, or ARP, which serve entirely unrelated network management or routing functions.

Correct Answer: MITRE ATT&CK
Explanation: MITRE ATT&CK is the widely adopted framework that catalogs real-world adversary tactics and techniques in matrix form for defense mapping, unlike the unrelated networking standards and mechanics listed.

Correct Answer: An Indicator object
Explanation: An Indicator object in STIX specifically represents an observable pattern (such as a hash or IP) used to detect malicious activity, unlike the unrelated networking or infrastructure records listed.

Correct Answer: Indicators and threat data can be automatically and rapidly ingested into security tools (such as firewalls or SIEMs) for near-real-time detection, without manual transcription
Explanation: The key benefit of structured, automated threat intel feeds is rapid, machine-readable ingestion into security tools for timely detection, avoiding slow, error-prone manual transcription, unlike the false claims in the distractors.

Correct Answer: A Technique
Explanation: In MITRE ATT&CK, a Technique describes a specific method (like phishing) used to achieve a broader Tactic (like Initial Access); Tactics represent the 'why' (goal) while Techniques represent the 'how', unlike CVE identifiers, CVSS scores, or DNS records which are unrelated concepts.

Correct Answer: Evaluating the source's reliability and the confidence level associated with the indicators before automating any blocking or response actions
Explanation: Evaluating source reliability and confidence levels before automated action is a sound practice to avoid false positives or blocking legitimate traffic based on low-quality intelligence, unlike blind trust, network-wide blocking, disabling internal tools, or unnecessary data sharing.

Correct Answer: A Relationship object (e.g., 'uses') connecting the Threat Actor object to the Malware object
Explanation: STIX uses explicit Relationship objects (such as 'uses') to connect related entities like a Threat Actor and the Malware they employ, unlike the unrelated networking protocol messages and records listed.

Correct Answer: Deduplicating overlapping indicators and reconciling differing confidence levels or context across providers to avoid alert fatigue and conflicting guidance
Explanation: A genuine, well-known challenge is deduplicating and reconciling overlapping or conflicting data across multiple feeds to avoid alert fatigue, unlike the false or exaggerated claims in the distractors.

Correct Answer: Mapping existing detection rules and tools against the ATT&CK matrix to visually identify which tactics and techniques currently have no corresponding detection coverage
Explanation: Mapping detection coverage against the ATT&CK matrix is a standard, practical use for identifying visibility gaps across known adversary tactics and techniques, unlike the decorative or entirely unrelated uses listed.