Indicators of Compromise (IoCs) CSA Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Why are TTPs considered more valuable than IoCs in long-term threat intelligence?

   • ATTPs are easier to automate in SIEM rules than IoCs
   • BTTPs are less likely to change over time and provide insight into attacker behavior
   • CTTPs are always unique to a single threat actor, while IoCs are shared across many actors
   • DTTPs are generated by automated tools, while IoCs require manual analysis
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is categorized as an email artifact IoC?

   • AThe domain name of the command-and-control server
   • BThe SHA-256 hash of a malicious attachment
   • CThe sender's email address used in a phishing campaign
   • DThe IP address of the phishing website linked in the email
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is a method for collecting IoCs from endpoint data?

   • AExamining NetFlow data for unusual data transfers
   • BReviewing the Windows Registry for persistence mechanisms
   • CMonitoring firewall logs for blocked inbound connections
   • DAnalyzing DNS query logs from the corporate DNS server
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   During an incident investigation, a SOC analyst identifies a suspicious executable that was downloaded from a URL, then later observed beaconing to an external IP address. The analyst wants to create detection rules that cover the earliest possible stage of the attack lifecycle. Which IoC should the analyst prioritize for detection?

   • AThe beaconing pattern
   • BThe external IP address
   • CThe download URL
   • DThe file hash of the executable
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A SOC team is building a threat intelligence program. They have access to open-source feeds, a commercial feed, and internal telemetry. They need to decide which source to use for a specific detection use case: detecting a newly emerging malware family that is not yet widely known. Which source would be most valuable for this use case?

   • AInternal telemetry from sandbox analysis of a sample obtained from a malware-sharing community
   • BHistorical incident reports from the organization
   • COpen-source threat intelligence feeds
   • DCommercial threat intelligence feeds
   Reveal Solution Discussion Select an answer first