Indicators of Compromise (IoCs) CSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the cyber kill chain, which stage is most likely to produce an IoC such as a suspicious email attachment?

   • AReconnaissance
   • BDelivery
   • CActions on Objectives
   • DCommand and Control (C2)
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SOC analyst is analyzing a set of IoCs from a recent incident. The IoCs include a file hash, a domain, and an IP address. The analyst needs to determine the severity and relevance of these IoCs to the organization. Which approach would provide the most accurate assessment?

   • AAssign severity based solely on the type of IoC, with IP addresses being the most severe.
   • BPrioritize IoCs that are publicly known and ignore those that are not.
   • CUse the number of IoCs observed as an indicator of severity.
   • DAssess each IoC against the organization's asset inventory and threat landscape, and consider the context of the incident.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which method is commonly used to collect IoCs from network traffic?

   • AChecking the browser history for malicious URLs
   • BExamining the file system for suspicious executables
   • CReviewing the Windows Event Log for failed login attempts
   • DAnalyzing NetFlow data to identify unusual communication patterns
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When analyzing an IoC, what does 'relevance' refer to?

   • AThe degree to which the IoC is applicable to the organization's environment and assets
   • BThe likelihood that the IoC is a false positive
   • CThe severity of the attack that the IoC indicates
   • DThe number of systems in the organization that could be affected by the IoC
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC team wants to enrich its detection capabilities with IoCs for a newly discovered ransomware family. The team has access to a commercial threat intelligence feed, a sandbox environment, and internal incident reports. Which approach would provide the most comprehensive and actionable IoCs for this ransomware?

   • ACombine IoCs from the threat intelligence feed, sandbox analysis, and internal incident reports.
   • BUse only the commercial threat intelligence feed because it is the most reliable source.
   • CUse only the sandbox analysis because it provides the exact file hashes and network indicators.
   • DUse only internal incident reports because they are specific to your organization.
   Reveal Solution Discussion Select an answer first