Exam CAS-005 topic 1 question 81 discussion

Why not the others? A. CWPP (Cloud Workload Protection Platform): Focuses on protecting cloud workloads, not for sharing intel across orgs. B. YARA: Used for defining malware patterns and rules for scanning files — not for sharing intelligence. C. ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge): A knowledge base of attacker behavior — useful for analysis, but not a format or method for sharing intel. F. JTAG (Joint Test Action Group): A hardware debugging standard, not relevant to threat intelligence sharing.

The correct answers are: D. STIX and E. TAXII Explanation: This scenario involves sharing threat intelligence in a structured and automated way between organizations. The technologies best suited for that purpose are: ✅ D. STIX (Structured Threat Information eXpression) A standardized language for describing cyber threat intelligence (CTI). Enables organizations to share and consume information in a consistent format. Ideal for structuring data on threats, indicators, TTPs, and more. ✅ E. TAXII (Trusted Automated eXchange of Indicator Information) A protocol specifically designed to transport cyber threat information (often formatted in STIX). Enables real-time automated exchange of threat intel between systems and partners.