CS0-003 Reporting and Communication Practice Question
A threat intelligence analyst has produced a report containing specific Indicators of Compromise (IoCs) such as IP addresses, domain names, and file hashes. Which TWO audiences are most appropriate for this type of intelligence? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SOC analysts
Tactical intelligence (IoCs) is most useful for the SOC team and incident responders who can use them for detection and response. Executives need strategic intelligence, and network engineers need operational intelligence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Board of directors
Why it's wrong here
The board of directors requires high-level information about organizational risk exposure, financial impact, and strategic threat trends rather than raw technical artifacts. A list of IoCs such as file hashes and C2 domains contains no executive context and would obscure the risk narrative. Board communications should be distilled into key risk metrics and mitigation status, not left as technical indicators for the C-suite to interpret.
- ✓
SOC analysts
Why this is correct
SOC analysts are the primary consumers for a report consisting of technical IoCs, as they operationalize these indicators into detection logic such as SIEM signatures and alert rules. The report should be structured to support correlation with telemetry, enabling prioritization and investigation of matching events. For the SOC, IoCs serve as the foundational input for proactive threat detection and ongoing security monitoring.
- ✗
Executive leadership
Why it's wrong here
Executive leadership, like the C-suite, consumes threat intelligence at a strategic level, focused on how threats affect business objectives, regulatory compliance, and resource allocation. Detailed indicators of compromise lack decision-making context and are typically stripped of the tactical specificity this audience neither needs nor wants. An executive-facing summary would consist of executive dashboards and geographic campaign trends, not raw technical artifacts.
- ✓
Incident responders
Why this is correct
Incident responders directly leverage IoCs during active investigations to scope the incident, query endpoint and network telemetry, and identify additional affected hosts. The indicators provide a concrete baseline for containment, eradication, and forensic correlation, and the report can guide hunt team activities. Though the SOC may triage alerts from the same indicators, IR is a key secondary audience for operational support during a confirmed breach.
- ✗
Network engineers
Why it's wrong here
Network engineers typically require operational security guidance — such as firewall rule recommendations, filtering guidance, or network segmentation changes — rather than a raw IOC report. While they may act on specific malicious infrastructure, IoCs are normally handed to the security detection teams to convert into detect-and-respond actions. Without transformation into network-specific mitigations, the report has limited direct utility for infrastructure teams.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
Tactical intelligence
Tactical intelligence is the analysis of real-time threat data to guide immediate defensive actions in a security operations center.
Key term
Threat intelligence
Threat intelligence is evidence-based knowledge about existing or emerging cyber threats that helps organizations defend against attacks.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.