Question library
Standards & sharing interview questions
Every question comes with the key points a strong answer covers, the mistakes that lose candidates points, and a vetted expert answer. Read them, then practise them under questioning.
2 questions matching your filters
- In STIX, what is the difference between a cyber-observable object and an indicator? And what does TAXII do that STIX does not? A standards question that doubles as a check on indicator thinking — the SCO/indicator distinction is the same distinction as data versus intelligence.
- You receive TLP:RED intelligence in a trust group indicating a specific vulnerability is being exploited against your sector. Your organisation is exposed. What do you do? A handling scenario with a deliberate conflict between an obligation and an urgent need to act. Inventing permission is the failure mode.
Practise these
Reading an expert answer and producing one under questioning are different skills. The simulator asks these questions, grades your answer against the same rubric you see here, and asks the follow-up an interviewer would ask next.