CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Offer detailed analysis of threat actor TTPs for specific campaigns

  Why this is correct

  Operational intelligence is the level of threat intelligence that examines threat actor TTPs (tactics, techniques, and procedures) within the context of a specific campaign or intrusion set. Unlike raw indicators, it provides defenders with the behavioral playbook of an adversary—such as initial access vectors, lateral movement methods, and command-and-control patterns—enabling proactive threat hunting, detection engineering, and tailored mitigation strategies. This type of analysis directly informs defensive actions by revealing not just what to block, but how to anticipate and disrupt an adversary's next move.

• ✗

  Deliver technical indicators like IoCs to SOC analysts

  Why it's wrong here

  Delivering technical indicators like IoCs (e.g., file hashes, IP addresses, domains) to SOC analysts is the hallmark of tactical intelligence. Tactical intelligence is designed for immediate, automated consumption—enabling detection at speed—but it lacks the broader context of an adversary's motivations, relationships, or campaign objectives. While IoCs are critical for short-term blocking and alerting, they become stale quickly and do not provide the deep campaign-level TTP analysis that operational intelligence offers.

• ✗

  Provide high-level trends to executive leadership

  Why it's wrong here

  Providing high-level trends to executive leadership is the role of strategic intelligence, which summarizes the overall threat landscape, emerging risks, and potential business impacts for senior decision-makers. Strategic intelligence is intentionally broad and forward-looking, often covering industry-wide attack patterns or geopolitical shifts, but it lacks the specificity and actionable detail required for day-to-day defensive operations. It informs risk appetite and investment priorities, not the granular TTP analysis needed to stop a particular campaign.

• ✗

  Summarize geopolitical risks affecting the organization

  Why it's wrong here

  Summarizing geopolitical risks affecting the organization is another form of strategic intelligence, focused on how nation-state relations, regulatory shifts, or regional conflicts might influence threat exposure at an enterprise level. This type of analysis helps executives understand the 'why' behind certain adversary behaviors, but it does not offer the tactical or operational detail needed to identify and respond to a specific intrusion campaign. It is essential for long-term planning, yet it is categorically different from the campaign-focused TTP analysis that operational intelligence delivers.

Go deeper

Related to this question