300-215 Question 158
Select 4A cybersecurity analyst at your organization is tasked with reviewing threat intelligence feeds to identify Indicators of Compromise (IOCs) and Indicators of Attack (IOAs). The analyst observes the following data in both internal and external feeds:
- A list of IP addresses flagged for hosting phishing websites.
- A sudden spike in failed login attempts from a specific geographic region.
- Malware hash values associated with recent ransomware campaigns.
- Behavioral patterns indicating lateral movement within the internal network.
Which of the following data points should the analyst classify as IOCs and IOAs?
- A
The list of IP addresses flagged for hosting phishing websites (IOC)
- B
The sudden spike in failed login attempts from a specific geographic region (IOA)
- C
The malware hash values associated with recent ransomware campaigns (IOC)
- D
The behavioral patterns indicating lateral movement within the internal network (IOA)
- E
The list of employee emails used for phishing campaigns (IOC)
Show answer and explanation
Correct answers: A, B, C, D
Explanation
Threat intelligence feeds provide both IOCs and IOAs. IOCs are observable artifacts (e.g., IP addresses, file hashes) linked to malicious activity, whereas IOAs represent behaviors or patterns (e.g., lateral movement, login attempts) that indicate potential attacks. Analysts must classify data correctly to respond effectively to threats.
- A. Correct.
This is an IOC because IP addresses associated with malicious activities are observable artifacts that indicate compromise.
- B. Correct.
This is an IOA because the spike in failed login attempts represents a behavior that may indicate an ongoing or attempted attack.
- C. Correct.
This is an IOC because malware hash values are definitive artifacts that can be used to identify malicious files.
- D. Correct.
This is an IOA because lateral movement is a behavior indicating an active attack, often used to escalate privileges or spread malware within a network.
- E. Incorrect.
This is incorrect because while employee emails used in phishing campaigns may be tied to an attack, they are not definitive artifacts that classify as IOCs in this scenario.