[&] What is an Indicator of Compromise (IOC)?
- A rule that automatically prevents future cyber attacks based on behavioral patterns
- A list of authorized software and services on an endpoint for compliance purposes
- A piece of forensic data that suggests a system may have been compromised -- Correct
- A real-time alert that always confirms a security breach is in progress

[&] Which of the following represents a file-based IOC?
- Network connection to a command and control server
- A suspicious file name found in AppData -- Correct
- An unusual login behavior observed
- An IP address linked to malware

[&] Which of the following is a limitation of network-based IOCs?
- They can be easily detected by firewalls
- They are often encrypted and obscure specific indicators -- Correct
- They require little to no maintenance
- They always provide reliable indicators of breaches

[&] Why might IP addresses be considered IOCs?
- They are the main focus of threat hunting
- They can indicate a known malicious source -- Correct
- They are difficult to trace
- They are always static

[&] How do behavioral IOCs differ from file-based IOCs?
- Behavioral IOCs focus on specific malware types.
- Behavioral IOCs focus on patterns and anomalies. -- Correct
- File-based IOCs are more reliable and long-lasting.
- File-based IOCs relate only to network traffic.