Exam 200-201 topic 1 question 256 discussion

IoC = Evidence of an attack that happened. IoA = Indicators that an attack will or can happen. IoA Digital or physical evidence of a cyberattacker's intent to attack. IOA detection focuses specifically on an adversary's motive rather than specific tools or methods used. https://www.strongdm.com/what-is/indicator-of-attack-ioa-security#:~:text=An%20indicator%20of%20attack%20(IOA,specific%20tools%20or%20methods%20used.

IOCs are artifacts that suggest a system has been breached, while IOAs are patterns of behavior that indicate an attack is underway

the answer is D This is correct because an Indicator of Compromise (IoC) is a sign that a system or network has already been compromised, and is used to determine if an attack has already occurred and to identify the scope of the compromise. An Indicator of Attack (IoA), on the other hand, is a signal or pattern that suggests an attack is currently underway or about to occur, and is used to detect and respond to an attack in progress.

Fo my is right D. I think that IoC is the evidence that a security breach has occurred. and IoA permit prepare for future methods of attack.

Answer: D This is correct because an Indicator of Compromise (IoC) is a sign that a system or network has already been compromised, and is used to determine if an attack has already occurred and to identify the scope of the compromise. An Indicator of Attack (IoA), on the other hand, is a signal or pattern that suggests an attack is currently underway or about to occur, and is used to detect and respond to an attack in progress.

I think clearly B --> IoA is the evidence that a security breach has occurred, and IoC allows organizations to act before the vulnerability can be exploited