Two organizations want to share threat indicators in a structured, machine-readable language and exchange them automatically between their platforms over HTTPS. Which pairing describes the roles correctly?
Select an answer to reveal the explanation.
Short Explanation
Think of STIX as the language a letter is written in and TAXII as the postal service that carries it. One describes the threat; the other moves it between servers over HTTPS. The trap is swapping them — the names are easy for you to flip under exam pressure.
Full Explanation
STIX, Structured Threat Information Expression, is a language and serialization format, using JSON in version 2.x, for describing cyber threat intelligence as objects such as indicators, malware, threat actors, attack patterns, and the relationships among them. TAXII, Trusted Automated Exchange of Intelligence Information, is an application protocol that runs over HTTPS and defines how clients and servers exchange that intelligence through collections, where consumers poll for objects, and channels. Together they let organizations publish and consume intelligence automatically without manual reformatting. Reversing the roles misstates both standards, since TAXII defines no data model for describing threats. Neither standard is an encryption mechanism; TAXII depends on HTTPS for transport security, and Traffic Light Protocol labels govern how widely recipients may redistribute information, not which protocol is used. Syslog over TLS is a logging transport and is not the standard used for exchanging STIX objects between threat intelligence platforms. Exam caveat: both standards are maintained under OASIS, and STIX objects can carry TLP markings as data markings. Operational check: confirm that the threat intelligence platform exposes a TAXII server endpoint, that the partner can authenticate and poll a collection, and that received objects parse as valid STIX.