What is the primary difference between an indicator of compromise (IOC) and an adversary tactic, technique, or procedure (TTP)?

IOCs are specific artifacts or behaviors, while TTPs describe the adversary's methods and patterns.

IOCs are used only for prevention, while TTPs are used only for recovery.

IOCs are always malicious, while TTPs are always benign.

IOCs are derived from TTPs, while TTPs are derived from IOCs.

GIAC Security Operations Manager

Domain 1Objective 1

Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 12)

Part of the SOC Strategy and Architecture domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 5–8 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

12concepts

Questions 56–56

56foundation · easy
What is the primary difference between an indicator of compromise (IOC) and an adversary tactic, technique, or procedure (TTP)?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 12)

Questions 56–56

What is the primary difference between an indicator of compromise (IOC) and an adversary tactic, technique, or procedure (TTP)?

Keep studying — SOC Strategy and Architecture