CS0-003 Reporting and Communication Practice Question
A security analyst needs to provide threat intelligence to different audiences. Which TWO of the following are appropriate dissemination approaches?
⚠ Common exam trap
CS0-004 often tests the appropriate audience for different intelligence types, and candidates may incorrectly assume broader sharing is better, ignoring confidentiality and relevance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sending tactical intelligence with IoCs to the SOC team
Option A is correct because tactical intelligence, which includes indicators of compromise (IoCs) such as IP addresses, hashes, and domains, is most actionable for the SOC team that monitors and responds to incidents in real time. Option E is correct because strategic intelligence reports are high-level, business-oriented summaries of threat trends and risks that help executives make informed decisions about security investments and risk posture. Option B is not appropriate because operational intelligence typically contains sensitive details about ongoing campaigns or adversary activity and should be shared only with authorized operational staff, not published broadly on the intranet. Option C is wrong because discussing classified threat data in public forums would cause unauthorized disclosure and violate classification and confidentiality requirements. Option D is wrong because sharing raw intelligence feeds with all employees exposes unvetted, potentially sensitive data to people without the need or training to interpret it, increasing risk of misuse or leakage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Sending tactical intelligence with IoCs to the SOC team
Why this is correct
Tactical intelligence is time-sensitive, actionable data that directly supports day-to-day security operations. SOC teams require IoCs—such as malicious IPs, file hashes, and domain names—to detect and block immediate threats. By pushing this information to the SOC, analysts can operationalize it and update detection rules, SIEM queries, and EDR configurations in real time.
- ✗
Publishing operational intelligence on the company intranet
Why it's wrong here
Operational intelligence describes adversary campaigns, TTPs, and targeted sectors, which is typically reserved for security managers and incident responders. Publishing it on a general intranet exposes sensitive analysis to all employees, many of whom lack the clearances or need-to-know, and could inadvertently leak confidential operational details to malicious insiders or external attackers.
- ✗
Discussing classified threat data in public forums
Why it's wrong here
Classified threat intelligence is subject to legal and regulatory handling restrictions, such as those defined by TLP or national classification frameworks. Discussing it in public forums risks disclosing protected sources, methods, and ongoing investigations, which can severely damage national security or the organization's legal posture, and is strictly prohibited over unauthorized channels.
- ✗
Sharing raw intelligence feeds with all employees
Why it's wrong here
Raw intelligence feeds are high-volume, unprocessed data streams that include false positives, incomplete context, and ambiguous indicators. General staff lack the technical expertise to interpret these feeds, and mass distribution would overwhelm employees, create desensitization, and likely lead to erroneous or even harmful responses to benign signals. Intelligence must be analyzed and refined before dissemination.
- ✓
Providing strategic intelligence reports to executives
Why this is correct
Strategic intelligence reports provide a high-level view of the threat landscape, focusing on emerging trends, broad adversary motivations, and potential business impact. Executives need this information to make informed decisions about risk tolerance, security investments, and overall governance. The report should translate technical threats into business-relevant context, avoiding operational minutiae while supporting long-term planning.
Go deeper
Related to this question
Learn chapter
API Security Testing and Analysis
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.