mediumMultiple ChoiceObjective-mapped
How to Handle TLP:AMBER+STRICT Indicators in a SOC
A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the alert triage phase, Which action gives the analyst the clearest next triage step?
Quick Answer
The answer is to use the indicators internally with only people who need to know and avoid wider redistribution. This is correct because TLP:AMBER+STRICT is a specific traffic light protocol (TLP) designation that restricts sharing to individuals within the organization who have a direct need to know for triage and response, explicitly prohibiting any redistribution beyond that circle. On the CompTIA CySA+ CS0-003 exam, this tests your understanding of information-sharing constraints during SOC operations, often appearing in questions about vendor-supplied threat intelligence and alert triage phases. A common trap is confusing TLP:AMBER+STRICT with standard TLP:AMBER, which allows limited sharing across an organization; the key difference is the “+STRICT” suffix, which locks the data to named individuals only. Remember the memory tip: “STRICT means stick to the specific team—no forwarding, no exceptions.”
⚠ Common exam trap
CompTIA often tests the misconception that TLP markings are merely advisory or optional, leading candidates to choose 'ignore' or 'publish' options, when in fact TLP is a mandatory handling framework with strict enforcement requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use them internally with only people who need to know and avoid wider redistribution
TLP:AMBER+STRICT restricts sharing to individuals within the organization who have a specific need to know, and prohibits any wider redistribution. In the alert triage phase, using the indicators internally ensures the SOC can investigate and respond without violating the information-sharing constraints set by the vendor, which is a mandatory security practice, not optional.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ignore the indicators because TLP markings are optional
Why it's wrong here
TLP markings guide handling and trust with information-sharing partners.
- ✗
Publish the indicators on a public GitHub repository
Why it's wrong here
Public redistribution violates the TLP restriction.
- ✗
Send the indicators to all customers
Why it's wrong here
The marking does not permit broad external sharing.
- ✓
Use them internally with only people who need to know and avoid wider redistribution
Why this is correct
TLP:AMBER+STRICT restricts sharing to the recipient organisation on a need-to-know basis.
Go deeper
Related to this question
Learn chapter
Security Metrics and KPIs
Key term
SOC
A Security Operations Center (SOC) is a centralized team that monitors, detects, analyzes, and responds to cybersecurity incidents to protect an organization's information systems.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CS0-004
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them?
medium- A.Publish the indicators on a public GitHub repository
- B.Send the indicators to all customers
- C.Ignore the indicators because TLP markings are optional
- ✓ D.Use them internally with only people who need to know and avoid wider redistribution
Why D: TLP:AMBER+STRICT restricts sharing to recipients within the organization who need to know, prohibiting further redistribution outside the organization. The SOC must use these indicators internally only with personnel who require them for detection and response, avoiding any external sharing. This ensures compliance with the Traffic Light Protocol (TLP) standard defined by FIRST.org. Note that the question also includes a second part about root-cause analysis findings; however, the provided options only relate to the handling of TLP markings. For the root-cause analysis phase, the finding would likely involve the misuse of indicators, but that is not reflected in the choices. Therefore, the correct answer based on the given options is D.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.