During the process of threat intelligence analysis, John, a threat analyst, successfully extracted an indication of adversary's information, such as Modus operandi, tools, communication channels…

Question

Options

• AOperational threat intelligence analysis
• BTechnical threat intelligence analysis
• CStrategic threat intelligence analysis
• DTactical threat intelligence analysis

• B
  9% (2)
• C
  5% (1)
• D
  86% (19)

Explanation

Tactical threat intelligence focuses specifically on adversary TTPs - Tactics, Techniques, and Procedures - which is exactly what John extracted: how attackers operate (modus operandi), what they use (tools), how they communicate (C2 channels), and how they avoid detection (forensics evasion). These are behavioral patterns that security teams use to understand and counter adversary methods directly.

• A (Operational) is wrong because operational intelligence concerns specific, near-term attack campaigns - the "what, when, where" of a pending or active threat, not general adversary behavior patterns.
• B (Technical) is wrong because technical intelligence is the most granular layer - specific IOCs like IP addresses, file hashes, malware signatures, and domain names, not behavioral methodology.
• C (Strategic) is wrong because strategic intelligence is high-level, intended for executives and decision-makers, covering threat trends, geopolitical risk, and organizational impact - not adversary tradecraft details.

Memory tip: Think "Tactical = TTPs" - both start with T. Tactical intelligence tells you how adversaries fight, just like military tactics describe how soldiers maneuver in battle.

No community discussion yet for this question.