Which of the following is not considered an Indicator of Compromise (IOC)?

The correct answer is D. A specific password for a compromised account. Option D is correct because a password - even one belonging to a compromised account - is a credential, not an observable artifact indicating that an attack occurred or is occurring. IOCs are forensic data points that security analysts use to detect and attribute malicious…

Introduction to Cybersecurity and Splunk

Question

Options

AA specific domain that is utilized for phishing.
BA specific IP address used in a cyberattack.
CA specific file hash of a malicious executable.
DA specific password for a compromised account.

How the community answered

(27 responses)

A
4% (1)
C
7% (2)
D
89% (24)

Explanation

Option D is correct because a password - even one belonging to a compromised account - is a credential, not an observable artifact indicating that an attack occurred or is occurring. IOCs are forensic data points that security analysts use to detect and attribute malicious activity on a network or system.

Options A, B, and C are all classic IOCs: a phishing domain, a malicious IP address, and a file hash each represent observable, shareable threat intelligence that can trigger alerts or block future attacks across different environments. A password, by contrast, is what gets stolen during a compromise - it's a target of the attack, not a signal that one happened.

Memory tip: Think of IOCs as "fingerprints left at the crime scene." Domains, IPs, and file hashes are things an attacker leaves behind or uses that you can detect. A password is something the attacker takes - it's the loot, not the fingerprint.

Topics

#indicators of compromise#IOC types#threat intelligence#cybersecurity fundamentals

Community Discussion

No community discussion yet for this question.

Full SPLK-5001 Practice