A security operations team is building a threat intelligence program and must decide how to allocate its budget. The team has identified two potential sources: a free open-source feed and a paid commercial feed. The commercial feed is known for high-quality, timely intelligence, but the team is concerned about cost. Which approach should the team take?

Use only the commercial feed for higher quality

Use both feeds, but prioritize the commercial feed for critical decisions

Use only the open-source feed to save money

Use neither feed and rely on internal analysis

An organization wants to share threat intelligence with other organizations in its industry sector, such as banks and financial institutions. Which type of sharing community is most appropriate for this purpose?

Computer Emergency Response Team (CERT)

Security Operations Center (SOC)

Information Sharing and Analysis Center (ISAC)

A threat intelligence team wants to collect information about emerging malware and vulnerabilities from publicly available sources such as security blogs, forums, and social media. Which type of threat intelligence collection method does this describe?

Open-source intelligence (OSINT)

A security team at a multinational corporation has identified a new malware campaign targeting their industry. They want to share this intelligence with partners and competitors, but they are concerned about revealing sensitive information about their own vulnerabilities. Which approach best balances sharing and protecting sensitive information?

Share only the indicators of compromise (IOCs) without revealing the exploited vulnerability

Share the information only with government agencies

Do not share any information to protect the company

Share all details including the exploited vulnerability to help others

During an incident response, an analyst identifies that the attacker used a spear-phishing email to deliver a malicious attachment, which then exploited a vulnerability to gain initial access. The attacker then moved laterally and exfiltrated data. Which term best describes this entire sequence of actions?

Tactics, Techniques, and Procedures (TTP)

CompTIACySA+

Domain 1Objective 4

Threat Intelligence and Hunting CS0-003 Practice Questions (Page 3)

Part of the Security operations domain, which accounts for 33% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~21–36 in this domain), expect 4–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

33%of the exam

Questions 11–15

11expert · hard
A security operations team is building a threat intelligence program and must decide how to allocate its budget. The team has identified two potential sources: a free open-source feed and a paid commercial feed. The commercial feed is known for high-quality, timely intelligence, but the team is concerned about cost. Which approach should the team take?
Select an answer first
12foundation · easy
An organization wants to share threat intelligence with other organizations in its industry sector, such as banks and financial institutions. Which type of sharing community is most appropriate for this purpose?
Select an answer first
13foundation · easy
A threat intelligence team wants to collect information about emerging malware and vulnerabilities from publicly available sources such as security blogs, forums, and social media. Which type of threat intelligence collection method does this describe?
Select an answer first
14expert · hard
A security team at a multinational corporation has identified a new malware campaign targeting their industry. They want to share this intelligence with partners and competitors, but they are concerned about revealing sensitive information about their own vulnerabilities. Which approach best balances sharing and protecting sensitive information?
Select an answer first
15foundation · easy
During an incident response, an analyst identifies that the attacker used a spear-phishing email to deliver a malicious attachment, which then exploited a vulnerability to gain initial access. The attacker then moved laterally and exfiltrated data. Which term best describes this entire sequence of actions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.

Threat Intelligence and Hunting CS0-003 Practice Questions (Page 3)

Questions 11–15

An organization wants to share threat intelligence with other organizations in its industry sector, such as banks and financial institutions. Which type of sharing community is most appropriate for this purpose?

A threat intelligence team wants to collect information about emerging malware and vulnerabilities from publicly available sources such as security blogs, forums, and social media. Which type of threat intelligence collection method does this describe?

Keep studying — Security operations