Which of the following is an example of an Indicator of Compromise (IOC)?

A vulnerability score from CVSS

A file hash of a known malware sample

The name of a threat actor group

Why do TTPs provide deeper context for threat hunting compared to IOCs?

TTPs are easier to automate than IOCs

TTPs describe the behavior and methods, allowing hunters to identify similar attacks even if indicators change

TTPs are static and do not change over time

TTPs are always unique to a single threat actor

How are Indicators of Compromise (IOCs) typically used in threat hunting?

To search logs and system artifacts for matches that indicate a potential compromise

To prioritize vulnerabilities based on exploitability

To predict future attack techniques based on adversary behavior

To automatically patch systems without human intervention

A threat hunter is reviewing a report about an advanced persistent threat (APT) group that uses spear-phishing emails with malicious attachments. The hunter wants to proactively search for signs of this activity in the email gateway logs. Which approach is most aligned with TTP-based hunting?

Search for emails with attachments that have unusual file extensions or that match the group's known attachment naming conventions

Search for the malware hash from the report

Search for the sender's email address from the report

Search for the exact subject line used in the reported phishing emails

EC-CouncilSOC Essentials

Domain 7Objective 5

Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 8)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

9concepts

9 Concepts in This Objective

Threat Intelligence Sources
Threat Intelligence Lifecycle
Indicators of Compromise (IOCs)
Tactics, Techniques, and Procedures (TTPs)
Threat Intelligence Integration
Hypothesis-Driven Hunting
Correlating Intelligence with Telemetry
Validation and Enrichment
Threat Hunting Feedback Loop

Questions 36–40

36foundation · easy
Which of the following is an example of an Indicator of Compromise (IOC)?
Select an answer first
37foundation · easy
Why do TTPs provide deeper context for threat hunting compared to IOCs?
Select an answer first
38foundation · easy
Which of the following is an example of an open-source threat intelligence source?
Select an answer first
39foundation · easy
How are Indicators of Compromise (IOCs) typically used in threat hunting?
Select an answer first
40application · medium
A threat hunter is reviewing a report about an advanced persistent threat (APT) group that uses spear-phishing emails with malicious attachments. The hunter wants to proactively search for signs of this activity in the email gateway logs. Which approach is most aligned with TTP-based hunting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.