What Type of Threat Intelligence Uses Human and Social Media Sources?
Leverox Solutions hired Arnold, a security professional, for the threat intelligence process. Arnold collected information about specific threats against the organization. From this information, he retrieved contextual information about security events and incidents that helped him disclose potential risks and gain insight into attacker methodologies. He collected the information from sources such as humans, social media, and chat rooms as well as from events that resulted in cyberattacks. In this process, he also prepared a report that includes identified malicious activities, recommended courses of action, and warnings for emerging attacks. What is the type of threat intelligence collected by Arnold in the above scenario?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can separate operational threat intelligence—context-rich, human-sourced event reporting—from strategic, tactical, and technical intelligence; the trap is choosing tactical because the scenario mentions attacker methodologies.
Arnold's collection of event context from human, social-media, and chat-room sources, plus his report of malicious activity and recommended actions, defines operational threat intelligence. This page confirms why option B fits CEH's threat-intelligence categories.
Many candidates pick tactical threat intelligence because Arnold studies attacker methodologies, but tactical intelligence focuses on TTPs and adversary behavior, whereas the human/chat-room event context and recommended-action report here are operational.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Arnold is collecting contextual information about security events and incidents from human sources, social media, and chat rooms, and he produces a report with malicious activities, recommended actions, and warnings. In CEH's threat-intelligence taxonomy, that human-centric, event-context, near-term reporting is operational threat intelligence. It is distinguished by its focus on understanding attacker methodologies and supporting defensive action, not by raw indicators or long-range business forecasting.Why the Other Options Are Wrong
Strategic intelligence addresses long-term business risk and executive decision-making; nothing in the scenario mentions board-level planning or market trends. Tactical intelligence concentrates on adversary TTPs and behavior patterns, which is a narrower behavioral focus than the event-context and human-source reporting described. Technical intelligence is dominated by machine-readable indicators, malware signatures, and feeds; Arnold's chat-room and social-media context plus recommended courses of action do not fit that profile.Community Comment Notes
qwerty100 and several voters selected operational threat intelligence, and insaniunt explained that it "focuses on the current and near-term threats" while giving context on security events, incidents, and risks. shaody added that this type helps defenders disclose potential risks and investigate malicious activity efficiently. LordXander's "CEHv12 65/66" note ties the scenario to the official CEH courseware classification.Exam Strategy
When a scenario names human sources, social media, chat rooms, and a report with warnings and recommended actions, classify it as operational threat intelligence. Reserve technical for IOCs/signatures, tactical for TTPs, and strategic for long-term business risk.
Frequently Asked Questions
Why is operational threat intelligence chosen over tactical threat intelligence here?
Tactical intelligence focuses on adversary TTPs and behavior; this scenario centers on contextual event reporting from human and social sources with recommended actions, which is operational.
Why isn't Arnold's collection classified as technical threat intelligence?
Technical intelligence is mainly machine-readable indicators, malware signatures, and feeds; Arnold's human/chat-room context and emerging-attack warnings are operational, not technical.