CREST Practitioner Security Analyst (CPSA) Practice

What does IOC stand for in cybersecurity?

1. Indications of Compromise

2. Indicators of Control

3. Instances of Compromise

4. Intelligence of Compromise

The correct answer is: Indications of Compromise

In the context of cybersecurity, IOC stands for Indicators of Compromise. This term refers to pieces of forensic data that suggest a breach has occurred, helping analysts detect unauthorized access or malicious activity within a network. IOCs are critical for identifying potential threats and vulnerabilities, as they provide insights into the tactics and techniques used by cyber attackers. These indicators can take various forms, such as unusual network traffic, known malicious IP addresses, file hashes, or specific registry keys that indicate malicious activity. By utilizing IOCs, cybersecurity professionals can respond effectively to incidents and fortify their defenses against future attacks. The other options, while they may seem plausible, do not accurately define IOC in the established terminology of cybersecurity. "Indicators of Control" and "Intelligence of Compromise" do not exist as recognized terms in this field, and "Instances of Compromise" also fails to capture the intent and functionality of IOCs. Understanding IOCs is foundational for security analysts as they navigate the complexities of threat detection and incident response.