[&] Which of the following describes advanced IOC correlation and pivoting by incident responders?
- Utilizing basic research tools to add IOC context
- Eliminating false positives to improve triage accuracy
- Mapping connections to uncover attacker behavior patterns -- Correct
- Automating the IOC enrichment process

[&] What is the primary purpose of IOC enrichment?
- To eliminate false positives from IOC analysis
- To enhance IOCs with additional contextual data to make them more actionable -- Correct
- To automate the IOC detection process
- To replace raw IOCs with more precise alternatives

[&] Which of the following is NOT a contextual data type used in IOC enrichment?
- Time-zone data -- Correct
- Autonomous System Number (ASN)
- Threat actor association
- Geolocation

[&] What is one of the main responsibilities of a Tier 1 SOC analyst in IOC handling?
- Generating new IOCs for organization-wide defenses
- Performing deep investigation into escalated alerts
- Triaging alerts and matching IOCs against known bad lists -- Correct
- Executing suspicious files in malware sandboxes