Which option best describes the role of an loC?

The correct answer is A. tags on a host that indicate that an infection event has occurred. An Indicator of Compromise (IoC) is a piece of forensic evidence - such as a file hash, registry key, IP address, or unusual process - found on a host that signals a security breach or infection has already occurred. Option A is correct because IoCs are observable artifacts that

Understanding Next-Generation Firewall Technology and Concepts

Question

Options

Atags on a host that indicate that an infection event has occurred
Bstatically assigned target values on a host
Ca flag that indicates that a host operating system needs patching
Dan impact flag of an infection event

How the community answered

(21 responses)

A
95% (20)
D
5% (1)

Explanation

An Indicator of Compromise (IoC) is a piece of forensic evidence - such as a file hash, registry key, IP address, or unusual process - found on a host that signals a security breach or infection has already occurred. Option A is correct because IoCs are observable artifacts that point to a past or active compromise event.

Why the distractors are wrong:

B is incorrect because IoCs are not statically assigned values; they are discovered dynamically during investigation or threat detection.
C is incorrect because patch status is a vulnerability indicator, not evidence of a compromise event.
D is incorrect because IoCs are not flags measuring the impact of an infection - they are the evidence that one occurred, used to detect and investigate it.

Memory tip: Think of IoC as a "crime scene clue" - it tells investigators that a crime happened, not how bad it was or how to prevent future crimes. The "C" stands for Compromise, meaning the breach already occurred.

Topics

#Indicator of Compromise#Host Infection Detection#Threat Detection#Malware Indicators

Community Discussion

No community discussion yet for this question.

Full 700-270 Practice