CS0-003 Incident Response and Management Practice Question
During a phishing incident, an analyst extracts a URL from the email body and searches VirusTotal. The URL is associated with a credential harvesting page. Which type of indicator is this URL?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Indicator of Compromise (IOC)
The URL is an observable that indicates malicious activity and can be used to detect and block further phishing attempts, making it an IOC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Indicator of Compromise (IOC)
Why this is correct
A malicious URL extracted from a phishing email serves as a classic Indicator of Compromise (IOC). Security analysts use these reactive, static artifacts—such as domain names, IP addresses, and file hashes—to identify systems that have already been breached or targeted. Once identified, IOCs are ingested into security tools like SIEMs and firewalls to block future traffic and scope the extent of the intrusion.
- ✗
Indicator of Attack (IOA)
Why it's wrong here
Indicators of Attack (IOAs) focus on the real-time execution of an adversary's tactics and intent, rather than static post-incident forensic artifacts. Examples of IOAs include active lateral movement, credential dumping, or unauthorized registry modifications occurring live on a host. A static phishing URL is a historical artifact of an attempted or successful breach, making it an IOC rather than an active IOA.
- ✗
Campaign
Why it's wrong here
A campaign represents a coordinated, sustained series of cyberattacks targeting specific industries or organizations over a set timeframe, often linked to a single threat actor. While a phishing email containing a malicious URL may be deployed as part of a broader campaign, the individual URL itself is merely a discrete technical artifact. It does not encompass the strategic, multi-phased nature of an entire campaign.
- ✗
TTP
Why it's wrong here
Tactics, Techniques, and Procedures (TTPs) describe the high-level behavioral patterns, methodologies, and operational strategies employed by threat actors. For instance, using spear-phishing with malicious links is a technique, whereas the specific extracted URL is a concrete, low-level indicator generated by that technique. TTPs categorize the 'how' of an attack, while IOCs represent the specific, observable evidence left behind.
Go deeper
Related to this question
Learn chapter
Business Email Compromise (BEC) Response
Key term
IOC
IOC stands for Indicator of Compromise, which is forensic evidence that a system has been breached or infected by malware.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.