Indicators of Compromise (IoC) and MITRE ATT&CK TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A threat intelligence team is managing a large repository of IoCs. They have noticed that some IoCs are no longer relevant, but they are unsure which ones to retire. The team wants to reduce false positives without losing valuable intelligence. Which approach is most effective?

   • AImplement a scoring system that considers the IoC's age, source reliability, and recent sightings, and retire those with low scores.
   • BKeep all IoCs indefinitely to avoid missing any threats.
   • CRetire IoCs that have not triggered any alerts in the past six months.
   • DRetire all IoCs that are older than six months.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security operations center (SOC) receives an alert for a known malicious IP address. The analyst investigates and finds that the IP address is a legitimate cloud provider's shared infrastructure, and the actual malicious activity is coming from a different IP. What is the best course of action regarding the IoC?

   • AEscalate the IoC to a higher priority because it is a cloud provider IP
   • BRefine the IoC to be more specific, such as adding a URL or domain associated with the malicious activity
   • CKeep the IoC as-is because the IP address is still a valid indicator
   • DDelete the IoC immediately because it is not useful
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team wants to prioritize their detection engineering efforts. They have identified a threat actor that is likely to target their industry. The team has access to MITRE ATT&CK and a list of the actor's TTPs. Which approach best uses ATT&CK to prioritize detections?

   • APrioritize techniques that are easiest to implement, regardless of the threat actor.
   • BImplement detections for all techniques in the ATT&CK framework.
   • CFocus on techniques that are used by the identified threat actor and that are currently not well covered by existing detections.
   • DUse ATT&CK to replace the existing SIEM with a new platform.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is reviewing a threat intelligence report that includes the following IoCs: a file hash, a domain, and a registry key. The analyst needs to determine which IoC is most likely to change over time and therefore requires more frequent updates. Which IoC is most likely to be volatile?

   • AThe domain, because domains can be taken down or re-registered
   • BThe registry key, because it is specific to the system
   • CAll IoCs are equally volatile
   • DThe file hash, because it is unique to the file
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat intelligence platform (TIP) contains an IoC for a command-and-control (C2) domain that was used in a campaign six months ago. The domain is no longer resolving, and no recent detections have been reported. According to IoC lifecycle best practices, what should the analyst do with this IoC?

   • AKeep the IoC active indefinitely because threat actors may re-register the domain
   • BReclassify the IoC as a false positive
   • CDelete the IoC immediately without documentation to free up storage
   • DRetire the IoC after confirming it is no longer active and documenting the reason
   Reveal Solution Discussion Select an answer first