Back to Security analytics and intelligence

Indicator of Compromise (IoC)

5 minutes 5 Questions

Indicator of Compromise (IoC) is a term used to describe pieces of information, typically in the form of artifacts like IP addresses, domain names, or file hashes, that suggest a potential security breach or intrusion has occurred. IoCs serve as forensic evidence and early warning signs of an attac…

Test mode:
Start practice test
CISSP - Indicator of Compromise (IoC) Example Questions

Test your knowledge of Indicator of Compromise (IoC)

Question 1

A security analyst is monitoring network traffic and detects an unusual amount of outbound connections to an unfamiliar IP address. Which of the following actions is the BEST response?

Correct Answer: Investigate the unfamiliar IP address

Investigating the unfamiliar IP address is the best response as it allows the analyst to gather more information on the potential Indicator of Compromise (IoC). Blocking the IP may result in loss of legitimate traffic, ignoring it could lead to further security risks, and the other measures are too disruptive without enough information to warrant their use.

Question 2

A system is experiencing slow network performance and analysis reveals continuous connections from an unknown IP. Which of the following could be the most appropriate IoC?

Correct Answer: DDoS attack

The continuous connections from an unknown IP suggest a potential Distributed Denial of Service (DDoS) attack on the system, causing slow network performance. The other options do not directly relate to the continuous connections from an unknown IP and slow network performance.

Question 3

During a security assessment, it is discovered that a remote user gained unauthorized access to a file server and potentially exfiltrated data. Which Indicator of Compromise (IoC) would be MOST indicative of this specific event?

Correct Answer: Increased network traffic

Increased network traffic is the most indicative IoC for unauthorized access to a file server by a remote user. When an attacker gains unauthorized access to a file server, they typically attempt to exfiltrate data by downloading large files or volumes of information. This activity results in a noticeable spike in network traffic, especially if the attacker is transferring significant amounts of data. While failed logon attempts might occur during the initial intrusion phase, successful unauthorized access would not necessarily generate multiple failed attempts. New administrator accounts, unusual email attachments, unusual DNS requests, and unused software installations are less directly related to the specific scenario of unauthorized file server access and data exfiltration.

More Indicator of Compromise (IoC) questions
30 questions (total)
Start 30 question test