Which Threat Intelligence Type Feeds Security Devices in Digital Format?
Roma is a member of a security team. She was tasked with protecting the internal network of an organization from imminent threats. To accomplish this task, Roma fed threat intelligence into the security devices in a digital format to block and identify inbound and outbound malicious traffic entering the organization's network. Which type of threat intelligence is used by Roma to secure the internal network?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the distinction between strategic, operational, tactical and technical threat intelligence; the trap is choosing tactical because both tactical and technical sound hands-on and adversary-focused.
Technical threat intelligence is the machine-readable threat data — IoCs such as hashes, domains and IP addresses — that firewalls, IPS/IDS and SIEM platforms ingest to block or detect malicious traffic. This page confirms why option D, not operational, strategic or tactical intelligence, matches Roma's device-fed scenario.
Learners often pick tactical threat intelligence because it is also low-level and adversary-focused, but tactical intelligence describes TTPs for human analysts, whereas technical intelligence is the digital, machine-consumable feed that security devices ingest.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Technical threat intelligence is the tier designed for automated consumption by security controls. It is delivered in digital formats such as IoC feeds, IP and domain blocklists, file hashes, and signatures that firewalls, IPS/IDS, SIEM and endpoint tools can ingest directly. Roma's action — feeding threat intelligence into security devices to identify and block inbound and outbound malicious traffic — is the textbook use case for technical threat intelligence. The key phrase in the stem is "digital format" being pushed into devices, which separates technical intelligence from the human-oriented strategic, operational and tactical tiers.Why the Other Options Are Wrong
Operational threat intelligence focuses on specific, real-time incidents and current attacker activity; it supports incident responders and situational awareness rather than serving as a raw device-consumable feed. Strategic threat intelligence provides long-term trends and risk context for senior management and policy decisions, so it is not fed into firewalls to block traffic. Tactical threat intelligence covers adversary tactics, techniques and procedures (TTPs) and is mainly used by analysts and hunters to understand how attacks are conducted, not as the digital IoC feed that devices automatically enforce. Therefore none of these options matches the machine-readable, device-ingested role described in the question.Community Comment Notes
Community learners converge on technical threat intelligence for this scenario. insaniunt highlights that the data includes "indicators of compromise (IoCs)" used to identify and block malicious traffic, which is the core of the technical tier. shaody states that technical threat intelligence is "directly fed into the security devices in digital format", matching the question's wording and Roma's workflow. kinaJ's explanation contrasts operational, strategic and tactical intelligence, reinforcing that the device-fed, digital-format use case belongs to technical threat intelligence, and no commenter argues for a different option.Official Reference
Exam Strategy
Memorize the four threat-intelligence tiers by their consumer and output: strategic for executives and trends, operational for live incidents, tactical for adversary TTPs used by analysts, and technical for machine-readable IoCs consumed by security devices. Whenever the stem mentions "digital format" or intelligence "fed into security devices," technical threat intelligence is almost certainly the intended answer.
Frequently Asked Questions
Why is tactical threat intelligence wrong when the data is fed into firewalls?
Tactical intelligence describes adversary TTPs for human analysis; it is not the machine-readable IoC feed that security devices ingest to block traffic automatically.
What makes operational threat intelligence different from technical threat intelligence?
Operational intelligence covers specific live incidents and real-time attacker activity for responders, while technical intelligence supplies device-consumable indicators such as hashes, IPs and domains.