フリー問題

問題文

Which two statements correctly distinguish indicators of compromise from indicators of attack? (Select two.)

選択肢

1. An indicator of attack is produced only after the incident is closed.
2. An indicator of attack describes activity in progress, such as a sequence of actions that suggests an attempt is under way.
3. An indicator of compromise is an artifact that shows something has already happened, such as a file hash or a contacted address found on the host.
4. An indicator of compromise can only be an address, while an indicator of attack can only be a file name.
5. Both terms mean the same thing, and the choice between them depends only on whether the source of the observation is a record produced inside the organization or a description published by an outside party such as a vendor advisory or a shared feed.