Operational Threat Intelligence focuses on threat actors to gain information about who they are, their motivations, and their TTPs.

• A. who they are
• B. their motivations
• C. who they are, their motivations, and their TTPs
• D. their office locations

Answer: (C)

Operational Threat Intelligence aims to build a profile of threat actors by uncovering who they are (identity or group behind the activity), why they operate (their motivations), and how they attack (their TTPs—tactics, techniques, and procedures). Knowing all three lets defenders anticipate actions, tailor detections, and prioritize responses. If you only know who they are, you miss the driver and typical methods; motivations alone miss the technical capabilities and likely behaviors; focusing on TTPs alone misses who is behind the actions and why they are targeting you. Office locations aren’t the central focus of this intelligence in terms of actionable threat behavior. In this sense, the most complete and useful understanding includes all three aspects: who they are, their motivations, and their TTPs.