Which of the following is an Indicator of Compromise (IOC)?

• A. A known attacker IP address
• B. A routine software update
• C. A backup file
• D. A user password policy

Answer: (A)

An Indicator of Compromise (IOC) is evidence that a security incident has occurred or is in progress. Seeing a known attacker IP address in your logs or network traffic is a prime IOC because it directly ties your environment to a malicious actor. When that IP appears contacting your network, it should trigger a deeper incident investigation, as it may indicate malware communication, unauthorized access, or data exfiltration. Keep in mind that a single IP address isn’t definitive proof on its own, but it’s a strong beacon when correlated with other signs like unusual outbound traffic, unexpected processes, or changes in files.

Routine software updates are expected, legitimate maintenance activity and don’t indicate a breach. A backup file is a recoverability asset, not a sign of compromise. A user password policy is a defensive control aimed at reducing risk, not evidence that an intrusion has occurred.