CSA (312-39) SOC Simulation Lab

Scenario Context

GreenTech Solutions has noticed an uptick in perimeter scanning against their public-facing API gateways. John, a dedicated Threat Intelligence Analyst on the team, is tasked with identifying the actor behind this activity before a major incident occurs.

Instead of relying purely on SIEM logs, John shifts his focus externally. He monitors specific hacktivist Telegram channels, scrapes chatter from deep web forums (using dummy accounts), and analyzes social media trends regarding GreenTech's upcoming controversial product launch.

Security Environment

Analyst: John (Threat Intel)
Current Task: Compiling an intelligence briefing for the Incident Response Lead.

This data provides the "Who", "Why", and "When" of an impending attack, directly informing immediate defensive postures.

Question

John, a threat analyst at GreenTech Solutions, wants to gather information about specific threats against the organization. He started collecting information from various sources, such as humans, social media, chat room, and so on, and created a report that contains malicious activity.

Which of the following types of threat intelligence did he use?

Expert Insight: Senior SOC Analyst Mentorship

What is happening:
John is stepping outside the traditional SIEM console to proactively hunt for adversary intent. By monitoring dark web forums (HUMINT/Deep Web) and social media (OSINT), he is gathering context about a specific, impending attack campaign. He isn't just looking at what the malware does; he's looking at who is deploying it and why.

Why D is correct:
Operational Threat Intelligence answers the "Who, What, and Why" of specific impending attacks. It relies heavily on gathering intel from human interactions, chat rooms, social media, and threat actor infrastructure tracking. It provides actionable context for SOC managers and Incident Responders to prioritize defenses for specific campaigns.

Why the others are wrong:

• Strategic (A): Consumed by the C-Suite and Board. It deals with long-term trends, financial impact, and high-level risk (e.g., "Ransomware costs in the energy sector are up 40%").
• Tactical (C): Consumed by SOC analysts and architects. Focuses on attacker methodologies, tools, techniques, and procedures (TTPs), often mapped to the MITRE ATT&CK framework.
• Technical (B): Consumed by automated systems (SIEMs, EDRs, Firewalls). This is the lowest level of intel, consisting of raw Indicators of Compromise (IOCs) like malicious IP addresses, file hashes, and domains.