Certified Incident Handler (CIH) Practice Ecam

What is the primary source of tactical threat intelligence?

1. Vulnerability reports

2. Campaign reports

3. Network traffic analysis

4. Employee interviews

The correct answer is: Campaign reports

Tactical threat intelligence primarily focuses on understanding immediate threats that organizations may face and the tactics, techniques, and procedures (TTPs) used by adversaries. Campaign reports serve as a vital source of this intelligence because they provide insights into specific threat actor activities, including current attack patterns, malware used, the targets selected, and the overall methods of operation. By analyzing campaign reports, security teams can obtain actionable information that can be applied directly to enhance defensive measures, improve detection capabilities, and develop strategies to mitigate risks associated with ongoing threats. This type of intelligence is critical for incident response teams and security analysts who need to respond swiftly to emerging threats and incidents based on the most current understanding of the threat environment. In contrast, vulnerability reports generally focus on known weaknesses in systems and software, while network traffic analysis offers a view of system behavior but does not necessarily identify the tactics of specific campaigns. Employee interviews can provide insights into internal processes but do not directly reflect external threats, making them less relevant as a tactical intelligence source.