Indicators of Compromise (IoC) and MITRE ATT&CK TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is reviewing a threat intelligence report that includes the following IoCs: an IP address, a file hash, and a registry key. The analyst wants to map these to MITRE ATT&CK techniques. Which approach is most appropriate?

   • AUse the context of the report to determine the behavior associated with each IoC, then map to the corresponding technique.
   • BDo not map IoCs to techniques because they are not related.
   • CMap the IP address to Initial Access, the file hash to Defense Evasion, and the registry key to Impact.
   • DMap the IP address to Command and Control, the file hash to Execution, and the registry key to Persistence.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common type of Indicator of Compromise (IoC)?

   • AA file hash of a known malware sample
   • BA company's public encryption key
   • CA network switch's MAC address table
   • DAn employee's username
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is investigating a potential breach. The SIEM shows a connection to a known malicious IP address, but no other alerts. The analyst wants to determine if this is a true positive. Which additional IoC would provide the strongest corroborating evidence?

   • AA registry key that was recently modified
   • BA scheduled task that runs a legitimate system utility
   • CA file hash of a known malware sample that matches a file on the host
   • DA domain that resolves to the same IP address
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   A security analyst sees a network IoC of a connection to a known malicious IP address on port 445. Which MITRE ATT&CK tactic is most likely associated with this activity?

   • ALateral Movement
   • BCollection
   • CImpact
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   How does MITRE ATT&CK help improve detection capabilities in an organization?

   • ABy automatically blocking all known malicious IP addresses
   • BBy providing a structured way to identify gaps in visibility and prioritize detection coverage
   • CBy providing a list of mandatory security controls for compliance
   • DBy replacing the need for threat intelligence feeds
   Reveal Solution Discussion Select an answer first