Indicators of Compromise (IoC) and MITRE ATT&CK TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat intelligence platform (TIP) is being configured to manage IoCs. The security team wants to ensure that IoCs are validated before being used in detection rules. Which process should be implemented?

   • AA process that prioritizes IoCs based on the number of characters in the indicator
   • BAutomatic ingestion of all IoCs from external feeds without review
   • CA validation workflow that checks the IoC against multiple sources and assesses its confidence score
   • DA manual review process that only checks the IoC's format
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is creating a threat intelligence report for a recent incident. The report includes the malicious file's SHA-256 hash, the C2 domain, and the registry key that was modified. What is the primary purpose of including these IoCs in the report?

   • ATo replace the need for MITRE ATT&CK mapping
   • BTo satisfy regulatory compliance requirements
   • CTo provide a detailed analysis of the adversary's motivations
   • DTo enable other organizations to detect and block the same threat
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A threat intelligence team is managing a large number of IoCs in their TIP. They have a limited number of analysts and need to prioritize which IoCs to investigate first. The team has the following IoCs: a file hash that is 6 months old, a domain that is known to be malicious but is currently not resolving, and a new IP address that has been observed in multiple recent campaigns. Which IoC should the team prioritize for investigation?

   • AAll IoCs equally, because they are all indicators
   • BThe domain, because it is known to be malicious
   • CThe file hash, because it is 6 months old and may be less relevant
   • DThe new IP address, because it is recent and observed in multiple campaigns
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is using MITRE ATT&CK to assess their detection coverage. They have identified that they have strong detection for Initial Access and Execution, but weak detection for Persistence and Exfiltration. What should the team do next?

   • AFocus on improving detections for Initial Access and Execution since they are already strong
   • BStop using ATT&CK because it has revealed too many gaps
   • CUse ATT&CK to replace the existing detection tools
   • DPrioritize developing detections for the weak areas, such as Persistence and Exfiltration
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An analyst observes a suspicious file hash in a sandbox report that shows the file creating a scheduled task for persistence. Which MITRE ATT&CK technique is most directly indicated by this IoC?

   • AData Obfuscation (T1001)
   • BExfiltration Over C2 Channel (T1041)
   • CScheduled Task/Job (T1053)
   • DBrute Force (T1110)
   Reveal Solution Discussion Select an answer first