CS0-003 Reporting and Communication Practice Question
A security analyst needs to provide threat intelligence to different audiences. Which TWO of the following are appropriate dissemination approaches?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sending tactical intelligence with IoCs to the SOC team
Strategic intelligence for executives helps them understand the threat landscape, while tactical intelligence for SOC teams provides IoCs for detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Sending tactical intelligence with IoCs to the SOC team
Why this is correct
Tactical intelligence is time-sensitive, actionable data that directly supports day-to-day security operations. SOC teams require IoCs—such as malicious IPs, file hashes, and domain names—to detect and block immediate threats. By pushing this information to the SOC, analysts can operationalize it and update detection rules, SIEM queries, and EDR configurations in real time.
- ✗
Publishing operational intelligence on the company intranet
Why it's wrong here
Operational intelligence describes adversary campaigns, TTPs, and targeted sectors, which is typically reserved for security managers and incident responders. Publishing it on a general intranet exposes sensitive analysis to all employees, many of whom lack the clearances or need-to-know, and could inadvertently leak confidential operational details to malicious insiders or external attackers.
- ✗
Discussing classified threat data in public forums
Why it's wrong here
Classified threat intelligence is subject to legal and regulatory handling restrictions, such as those defined by TLP or national classification frameworks. Discussing it in public forums risks disclosing protected sources, methods, and ongoing investigations, which can severely damage national security or the organization's legal posture, and is strictly prohibited over unauthorized channels.
- ✗
Sharing raw intelligence feeds with all employees
Why it's wrong here
Raw intelligence feeds are high-volume, unprocessed data streams that include false positives, incomplete context, and ambiguous indicators. General staff lack the technical expertise to interpret these feeds, and mass distribution would overwhelm employees, create desensitization, and likely lead to erroneous or even harmful responses to benign signals. Intelligence must be analyzed and refined before dissemination.
- ✓
Providing strategic intelligence reports to executives
Why this is correct
Strategic intelligence reports provide a high-level view of the threat landscape, focusing on emerging trends, broad adversary motivations, and potential business impact. Executives need this information to make informed decisions about risk tolerance, security investments, and overall governance. The report should translate technical threats into business-relevant context, avoiding operational minutiae while supporting long-term planning.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SOC
A Security Operations Center (SOC) is a centralized team that monitors, detects, analyzes, and responds to cybersecurity incidents to protect an organization's information systems.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.