Indicators of Compromise (IoC) and MITRE ATT&CK TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations center (SOC) wants to improve its detection capabilities by moving from a purely signature-based approach to a behavior-based approach. The team has access to MITRE ATT&CK and a SIEM that can ingest logs from endpoints and network devices. Which strategy best leverages ATT&CK to achieve this goal?

   • AReplace the SIEM with an EDR that has built-in ATT&CK mapping.
   • BMap current detections to ATT&CK techniques, identify gaps, and create new detections for high-value techniques that are currently unmonitored.
   • CDeploy additional antivirus signatures for known malware families.
   • DFocus only on blocking known malicious IP addresses and domains.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A threat intelligence analyst is correlating IoCs from multiple sources. One source reports a file hash as associated with a banking trojan. Another source reports the same hash as associated with a ransomware family. The analyst needs to map the hash to MITRE ATT&CK techniques. Which approach is most appropriate?

   • AIgnore the hash and rely on other IoCs to determine the techniques.
   • BMap the hash to the techniques that are common to both families.
   • CMap the hash to techniques from both the banking trojan and ransomware families.
   • DUse the hash to identify the specific malware family and then map to that family's techniques.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team has been using a list of file hashes from a third-party feed to block malware. Over time, they notice an increasing number of false positives and missed detections. The team suspects the IoCs are outdated. What is the best way to manage the IoC lifecycle to address this issue?

   • AImmediately remove all third-party IoCs and rely on internal detections.
   • BSwitch to a different third-party feed without reviewing current IoCs.
   • CIncrease the alert threshold to reduce false positives.
   • DEstablish a regular review process to validate IoCs, remove stale ones, and add new ones from trusted sources.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is reviewing a threat intelligence report that lists the following IoCs: a malicious IP address, a file hash, and a registry key. The analyst wants to map these IoCs to MITRE ATT&CK techniques. Which approach is most effective?

   • AAnalyze the behavior associated with each IoC and map it to the relevant technique
   • BMap the IP address to Command and Control, the file hash to Execution, and the registry key to Persistence
   • CSubmit the IoCs to MITRE for automatic mapping
   • DUse the IoC type to determine the technique, such as IP addresses always being Command and Control
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the final stage in the lifecycle of an Indicator of Compromise (IoC)?

   • ADeployment
   • BRetirement
   • CDiscovery
   • DValidation
   Reveal Solution Discussion Select an answer first