What is an Indicator of Compromise (IOC) and give two examples.

• A. A piece of evidence that suggests a security breach; examples include a known attacker IP address and a file hash linked to malware
• B. A routine software update and a change log
• C. A user password policy and a login attempt limit
• D. A firewall rule set and an access control list

Answer: (A)

An Indicator of Compromise is evidence that suggests a security breach has occurred, serving as artifacts that help detect or investigate intrusions. Two common examples are a known attacker IP address appearing in logs and a file hash that matches a malware sample. These indicators point to malicious activity and help responders trace what happened and where it affected systems. The other items are not IOCs: routine software updates and changelogs reflect maintenance activity, not signs of compromise; password policies and login attempt limits are protective controls; and firewall rules or access control lists are defensive configurations, not evidence that a breach occurred.