Which of the following should be updated NEXT?

A threat hurting team received a new loC from an ISAC that follows a threat actor’s profile and activities.

Which of the following should be updated NEXT?
A . The whitelist
B. The DNS
C. The blocklist
D. The IDS signature

View Answer

Answer: D

Explanation:

The IDS signature should be updated next after receiving a new IoC (Indicator of Compromise) from an ISAC (Information Sharing and Analysis Center) that follows a threat actor’s profile and activities. An IoC is a piece of evidence or artifact that suggests a system or network has been compromised or attacked by a threat actor4. An IoC can be an IP address, domain name, URL, file hash, email address, registry key, etc. An ISAC is a nonprofit organization that collects, analyzes, and shares threat intelligence and best practices among its members within a specific sector or industry5. An ISAC can help to improve the security awareness and preparedness of its members by providing timely and relevant information about emerging threats and incidents.