312-39 Proactive Threat Detection Practice Question
Which THREE actions should be taken after an indicator of compromise (IOC) is identified to ensure it is effectively used in a proactive detection program?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the EDR to perform a 'Sweep' for historical occurrences of the IOC
IOCs must be vetted, added to watchlists, and monitored for matches to be useful.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the EDR to perform a 'Sweep' for historical occurrences of the IOC
Why this is correct
Historical sweeps identify if the threat has already penetrated the network.
- ✗
Share the IOC publicly on social media before internal investigation
Why it's wrong here
Sharing unvetted or sensitive internal IOCs poses a security risk.
- ✓
Validate the IOC against internal sandbox results to confirm its malicious nature
Why this is correct
Internal validation reduces the risk of false positives from noisy intelligence.
- ✓
Add the IOC to a SIEM watchlist for real-time alerting on matches
Why this is correct
Watchlists enable immediate identification of the threat across the environment.
- ✗
Ignore the IOC if it is older than 30 days
Why it's wrong here
Older IOCs can still be relevant if they are related to a long-term adversary campaign.
About these practice questions
This 312-39 question is part of Courseiva's 202-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This 312-39 practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 312-39 exam.