7 Threat Analysis Practice Free Online FlashCards

How does an IOC differ from a vulnerability?

An IOC is evidence that an incident may have occurred or may be underway; a vulnerability is a weakness that could be exploited.

Why separate observations from hypotheses?

Record observed facts separately from hypotheses. For example, a new mailbox rule is an observation; account takeover is a possible explanation.

What can a single alert establish about an attacker?

Neither an IOC nor a single alert proves who is responsible. Correlate evidence, build a timeline, and revise the assessment as facts emerge.

What can MITRE ATT&CK help an investigation do?

MITRE ATT&CK organizes adversary actions by goals and techniques, helping structure an investigation; it does not prove an actor’s identity.

What factors should shape incident priority?

Assess likelihood and impact alongside exposure, active exploitation evidence, asset criticality, scope, and available safeguards. Explain the reasons behind the priority.

What is a sound order for incident response actions?

Contain active harm, protect affected accounts and systems, preserve evidence, remove the cause, recover safely, then improve detection and prevention.

Why should analysts correlate multiple indicators over time?

A single indicator may have a legitimate explanation. Combinations of indicators and their timing are more informative.

Which payroll-case clues together support account compromise?

An unexpected MFA approval, an unfamiliar sign-in, and a new forwarding rule together support an account-compromise hypothesis.

What immediate steps address the changed payroll account?

Contact the employee through a trusted channel, secure the account, revoke sessions and tokens, reset credentials, remove unauthorized rules, and independently verify payment changes.

In the remote-access case, which signs are the vulnerability and which are IOCs?

The outdated software is a vulnerability; suspicious requests, a new administrator account, and an unexpected external connection are potential IOCs.

What alternatives should be considered after suspicious activity follows a software update?

The timing raises a supply-chain compromise hypothesis, but a faulty update, configuration change, or separate intrusion could also explain the evidence.

Why is the changed payroll account case high priority?

Treat the case as high priority: the account may remain usable and fraudulent payment could cause direct loss.