312-39 · Question #35
During a threat intelligence briefing, a SOC analyst comes across a classified report detailing a sophisticated cybercrime syndicate targeting executives of high-profile financial institutions…
The correct answer is A. Human Intelligence. Human Intelligence (HUMINT) involves information gathered from people, relationships, and human behavior rather than purely technical artifacts. The scenario describes adversaries using social engineering and pretexting-building trust through conversations and manipulating…
Question
During a threat intelligence briefing, a SOC analyst comes across a classified report detailing a sophisticated cybercrime syndicate targeting executives of high-profile financial institutions. These adversaries rarely leave digital footprints and seem to anticipate security measures. Several breaches began with seemingly innocent conversations: a foreign journalist requesting an interview with a CEO and a “security consultant” offering free risk assessments. Further investigation reveals attackers socially engineered employees, manipulated trust, and extracted critical security details long before launching technical attacks. The analyst decides to focus on intelligence involving deception detection and psychological profiling to uncover true intent and methods. Which type of intelligence is the analyst leveraging?
Options
- AHuman Intelligence
- BThreat Intelligence Feeds
- COpen-Source Intelligence (OSINT)
- DTechnical Threat Intelligence
How the community answered
(48 responses)- A83% (40)
- B2% (1)
- C10% (5)
- D4% (2)
Explanation
Human Intelligence (HUMINT) involves information gathered from people, relationships, and human behavior rather than purely technical artifacts. The scenario describes adversaries using social engineering and pretexting-building trust through conversations and manipulating employees to reveal sensitive information. The analyst is focusing on deception detection and psychological profiling, which are rooted in understanding human intent, influence tactics, and interpersonal manipulation patterns. That aligns with HUMINT, where insights may come from interviews, insider that logs will not show. Threat intelligence feeds and technical threat intelligence primarily provide machine-consumable indicators, malware signatures, infrastructure data, and observed TTPs; they are valuable but not the main lens here because these attackers “rarely leave digital footprints.” OSINT is derived from publicly available sources, which can help identify personas or prior campaigns, but the core described intelligence method is interpreting human behavior and social manipulation. From a SOC standpoint, HUMINT-driven insights inform security awareness training, executive protection protocols, identity verification procedures, and “out-of-band” validation processes that reduce success of pretexting and business email compromise.
Topics
Community Discussion
No community discussion yet for this question.