Practice · XDR Analyst

~/paloalto-xdr-analyst · paloalto-xdr-analyst_d1_991ec9dc223e ▊

paloalto-xdr-analyst_d1_991ec9dc223e domain/d1 · medium single

An analyst is evaluating detection methods and wants to move beyond simple indicator-of-compromise matching to catch targeted attacks. Based on the threat hunting solution brief, which statement best reflects the limitation of IOC-based detection?

A Targeted attacks can't be stopped with IOCs, so more elaborate use cases relying on full TTPs are needed
B IOC-based detection produces the fewest false positives of any technique
C IOCs are the only reliable data source for threat hunting maturity
D IOC detection requires the eXtended Threat Hunting Data Module to function

Unlock this exam to join the per-question discussion and vote on questions.

next question →