Indicators of Compromise in IT Security

The video tutorial discusses various indicators of compromise (IOCs) in IT security, such as unusual network traffic, account lockouts, impossible logins, and resource consumption. It highlights the importance of monitoring these indicators to detect potential security breaches. The tutorial also emphasizes the need for strong security processes to prevent impersonation and data exfiltration, and the role of log analysis in identifying unauthorized access.

What is an Indicator of Compromise (IOC) in IT security?

• Evidence that a system has been compromised

• A method to enhance system performance

• A tool for network optimization

• A sign that a system is functioning normally

Which of the following could indicate a change in file integrity?

• Increased network speed

• Improved user interface

• Decreased system uptime

• Modified hash values of files

What might an unexpected account lockout suggest?

• A new software installation

• A scheduled maintenance

• An indicator of compromise

• A routine system update

Why might an attacker intentionally lock a user account?

• To reset the password through impersonation

• To enhance user experience

• To improve system security

• To update the user's profile

What does an 'impossible login' refer to?

• Simultaneous logins from distant locations

• Logging in with a temporary account

• Logging in with a guest account

• Logging in without a password

How can attackers maintain access to a compromised system?

• By optimizing network settings

• By increasing system resources

• By disabling antivirus updates

• By enabling all security updates

What might a sudden spike in network traffic indicate?

• A new software installation

• A system upgrade

• A routine backup process

• Data being transferred by an attacker

What is 'out-of-cycle logging'?

• Logs that are deleted after a system update

• Logs that are archived for future reference

• Logs that appear unexpectedly outside normal schedules

• Logs that are generated during regular maintenance

Why might attackers delete log information?

• To free up storage space

• To hide their presence on the system

• To improve system performance

• To comply with data regulations

What could the sudden appearance of private data on the internet indicate?

• A data breach and exfiltration

• A system upgrade

• A successful marketing campaign

• A new software release