MENU
An on-call security engineer has been notified after business hours that a possible threat could be impacting production applications.
Which type of threat intelligence should be used by first responders?
The correct answer is A --- Tactical.
Based on WGU Cybersecurity Architecture and Engineering (KFO1 / D488) study material, tactical threat intelligence provides technical details such as indicators of compromise (IOCs), IP addresses, file hashes, domain names, and other evidence needed to detect and respond to threats immediately. This type of intelligence is used by security teams to perform real-time monitoring and incident response.
Operational intelligence (C) addresses campaigns or actor behavior but is not immediately actionable. Strategic intelligence (D) provides high-level, long-term threat trends. Commodity malware (B) refers to low-level malware types, not intelligence classifications.
Reference Extract from Study Guide:
'Tactical threat intelligence focuses on technical indicators of compromise (IOCs) and immediate actionable information that responders use to detect and contain active threats.'
--- WGU Cybersecurity Architecture and Engineering (KFO1 / D488), Threat Intelligence Concepts
=============================================