What defines an Indicator of Compromise (IOC)?

• A. A set of conditions or evidence that indicates a system may have been compromised.
• B. A vulnerability scan result.
• C. A plan to restore systems.
• D. A security policy.

Answer: (A)

An IOC is a piece of evidence that suggests a system has been compromised. It consists of observable artifacts left by attackers or generated by malicious activity, such as a known malware file hash, a domain or IP associated with a command-and-control server, unusual network patterns, a suspicious registry change, or a rogue process name. IOCs are used to detect intrusions and to bolster investigation by showing that malicious activity occurred or is underway. However, a single indicator isn’t definitive proof on its own; it becomes more compelling when multiple, related indicators align with threat intel and telemetry from the environment.

Vulnerability scan results, by contrast, identify weaknesses that could be exploited but do not prove that an attack has happened. A plan to restore systems is a recovery action, not evidence of compromise. A security policy is governance guidance, outlining rules and procedures rather than artifacts of a breach.