Indicators of Compromise (IoCs) CSA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC analyst is triaging a list of IoCs from an open-source threat feed. The list includes a file hash, a domain, and an IP address. The analyst needs to prioritize which IoCs to investigate first. Which factor should be the primary consideration when prioritizing these IoCs?

   • AThe type of IoC (hash, domain, IP)
   • BThe age of the IoC in the threat feed
   • CThe relevance of the IoC to the organization's environment and assets
   • DThe number of times the IoC appears in the feed
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   During an incident, a SOC analyst identifies a malicious domain that is being used for C2. The analyst wants to integrate this IoC into the incident response process. Which step should the analyst take to support containment?

   • ADocument the domain in the incident report
   • BShare the domain with other SOC teams
   • CBlock the domain at the DNS or proxy level
   • DAdd the domain to the SIEM watchlist
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary difference between an Indicator of Compromise (IoC) and a Tactic, Technique, or Procedure (TTP)?

   • AIoCs are static and never change, while TTPs are dynamic and evolve over time
   • BIoCs are always network-based, while TTPs are always host-based
   • CIoCs are specific artifacts that indicate a compromise, while TTPs describe the behavior and methods used by an attacker
   • DIoCs are used for detection, while TTPs are used for prevention only
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an internal host is communicating with an external IP address on a non-standard port. Which data source would provide the most direct evidence of the communication?

   • ADNS logs from the internal DNS server
   • BEmail gateway logs
   • CNetflow data from the router
   • DWindows event logs from the host
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A threat intelligence analyst is writing a report about an advanced persistent threat (APT) group. The analyst has identified several IoCs and also observed the group's TTPs. Which statement correctly explains why TTPs are often considered more valuable than IoCs for long-term defense?

   • ATTPs are less likely to generate false positives than IoCs.
   • BTTPs describe the behavior and methodology of the attacker, which are more stable and harder to change than specific IoCs.
   • CTTPs are always unique to a single APT group, making them highly reliable.
   • DTTPs are easier to automate in detection systems than IoCs.
   Reveal Solution Discussion Select an answer first