English
Menu

Cyber Attacks and Defense in Practice

Which of the following correctly describes the IoC (indicator of compromise) and IoA (indicator of attack) used in threat detection?

  1. AIoCs focus on the attacker's behavior and intent, while IoAs are concrete traces such as malware hash values and the IP addresses of C2 servers
  2. BIoCs are concrete traces of a compromise such as malware hash values and the IP addresses of C2 servers, while IoAs focus on attacker behavior such as attempts to steal credentials
  3. CBoth IoCs and IoAs express the severity of a vulnerability as a number from 0.0 to 10.0 and are used to decide the order in which to apply fixes
Show answer and explanation

Answer: B. IoCs are concrete traces of a compromise such as malware hash values and the IP addresses of C2 servers, while IoAs focus on attacker behavior such as attempts to steal credentials

An IoC (indicator of compromise) is a concrete trace showing that a compromise has occurred, such as the hash value of a malware file, the IP address or domain name of a C2 server, or a characteristic file name. IoCs are shared with other organizations and threat intelligence providers and matched against the organization's own logs and endpoints to check whether it has been hit by the same attack. However, attackers can easily change hash values and IP addresses, so IoCs are combined with IoAs (indicators of attack), which focus on behaviors that are harder for attackers to change, such as attempts to steal credentials or internal movement using legitimate tools.

  • A. The descriptions are reversed. Concrete traces are IoCs, and IoAs focus on behavior.
  • B. Correct. Concrete traces are IoCs, and IoAs focus on attacker behavior.
  • C. Expressing the severity of a vulnerability as a number is CVSS.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Which of the following correctly describes the difference in roles between a CSIRT and a PSIRT set up within an organization?
  2. The logs of two servers are being compared in an intrusion investigation. The web server logs in Coordinated Universal Time (UTC), and its clock was set correctly by NTP. The file server logs in Japan time (UTC+9 hours), and its clock was 4 minutes ahead of the correct time. The web server log records a suspicious login at 01:52 (UTC), and the file server log records a mass read of files at 10:58 (Japan time). How many minutes after the suspicious login did the file reads actually happen?
  3. In the same week, fixes were released for three vulnerabilities. The operations staff can apply only one fix per day. Which of the following is the most appropriate combination of the fix to apply first and the reason?
  4. Which of the following correctly describes the differences between vulnerability scanning, penetration testing and red team exercises as ways of checking an organization's defenses?
  5. An outside security researcher has found an undisclosed vulnerability in a company's product. Which of the following is the most appropriate way to proceed according to the idea of coordinated vulnerability disclosure?

Comparisons in this topic