Indicators of Compromise

Question 1 of 6

An employee's Active Directory account is locked out. The employee contacts the help desk and states they have not attempted to log in this morning. What is the MOST accurate characterization of this event?

This is a normal operational occurrence caused by an expired password and requires no further investigation beyond a standard reset. This is an Indicator of Compromise — the lockout was caused by unauthorized login attempts, which may itself be the first phase of a social engineering attack to obtain a password reset. This is a false positive — lockouts caused by automated service accounts are common and should be resolved without an investigation. This is an impossible travel event — it indicates the employee's credentials are being used simultaneously from two locations.

Question 2 of 6

Authentication logs show that the same user account logged in successfully from Chicago, Illinois at 10:02 AM and from Tokyo, Japan at 10:09 AM — a distance of approximately 10,100 km. What type of Indicator of Compromise does this represent, and what is the correct response?

Concurrent session usage — the user likely has a VPN that makes the Chicago login appear as Tokyo. No immediate action is required. Impossible travel — the 10,100 km distance cannot be covered in 7 minutes by any means of transportation. The Tokyo session must belong to an unauthorized party; terminate it and force a credential reset. Out-of-cycle logging — the Tokyo login occurred outside of the user's normal business hours and should be flagged for review at the next weekly security meeting. Resource consumption — the user is accessing systems from two locations simultaneously, which may indicate credential sharing rather than credential theft.

Question 3 of 6

A security engineer finds that a compromised workstation can successfully browse news websites and use web applications normally, but consistently fails to reach Windows Update, its antivirus vendor's update server, and the Malwarebytes download site. Which IoC category does this represent and what is the attacker's goal?

Resource inaccessibility — a ransomware infection has begun encrypting the system's files and is consuming all available network bandwidth. Missing logs — the attacker has deleted the DNS resolution cache to prevent security tools from finding the malicious domain. Blocked content — the attacker has modified the system to prevent security updates and removal tools from reaching the compromised host, ensuring the malware persists without being patched out or detected by updated signatures. Out-of-cycle logging — the system's update schedule has been modified by the attacker to run at different times, causing apparent connectivity failures.

Question 4 of 6

A network operations center alert fires at 2:47 AM: an internal file server is transferring 38 GB of data outbound to an IP address in a foreign country. The server's normal nightly outbound traffic is under 400 MB. Which IoC category best describes this, and what does it most likely indicate?

Resource inaccessibility — the server has been taken offline by ransomware and is no longer responding to internal connections. Out-of-cycle logging — the server's backup job has been incorrectly configured to run to an external destination outside the maintenance window. Resource consumption — the anomalous bandwidth spike indicates active data exfiltration; an attacker is transferring a large volume of organizational data to an external attacker-controlled server. Account lockout — the server's service account has been locked by too many failed authentication attempts from the external destination.

Question 5 of 6

A forensic investigator reviewing a database server finds that authentication log entries are completely absent for a 4-hour window on the date a data theft is believed to have occurred. The server was online and functioning normally during that period. What does this most likely indicate?

The authentication service was stopped for scheduled maintenance during that window and the absence of logs is expected and documented. The log absence is an IoC — an attacker with access to the server deleted the authentication logs to erase evidence of their login sessions during the theft window. The absence of logs that should exist is itself forensically significant. This is a concurrent session usage IoC — the server was being accessed from multiple locations simultaneously and the logging system could not handle the volume. This is an impossible travel event in the log data — the timestamps jump from before to after the gap, indicating the server's clock was manipulated.

Question 6 of 6

An organization's legal team receives a ransom demand containing a 500-record sample of employee HR data as proof. The security team has no prior detection of any breach. What IoC category does this represent, and what is the correct understanding of the breach timeline?

This is the initial compromise event — the attacker just obtained the data and the organization's response window begins now. This is a published/documented data IoC — the exfiltration already happened, likely weeks or months ago. The ransom demand is the first observable IoC, but the breach timeline extends backward to the original access and exfiltration events that generated no detected signals at the time. This is an out-of-cycle logging event — the ransom demand arrived outside business hours and indicates the attacker is operating in a different time zone. This is a resource inaccessibility IoC — the attacker has encrypted the HR system's data and is demanding payment for the decryption key.

Matching — IoC to Category

Match each observed event on the left to its IoC category on the right.

1. Firewall logs show a 3-hour gap with zero entries during a period when network anomalies were detected upstream

2. A patch installation log entry appears at 3:15 AM on a Tuesday — the organization's patch window is Saturday nights only

3. A user account is active in New York at 14:00 and in Singapore at 14:04

4. An internal server begins generating 10× its normal outbound bandwidth at 4 AM, sending data to an unknown external IP

1. 2. 3. 4.

A. Resource Consumption — anomalous bandwidth or system utilization indicating active attacker activity such as data exfiltration

B. Missing Logs — absence of log entries that should exist, indicating deliberate deletion of forensic evidence

C. Out-of-Cycle Logging — administrative activity recorded outside expected operational schedules

D. Impossible Travel — authentication from two geographically distant locations within a physically impossible timeframe

Indicators of Compromise Quiz

Matching — IoC to Category