Exam ISO-IEC-27035-Lead-Incident-Manager Topic 4 Question 79 Discussion

Comprehensive and Detailed Explanation From Exact Extract:
Indicators of Compromise (IOCs) are critical elements in incident management. They are forensic artifacts- such as file hashes, IP addresses, registry changes, or specific malware behavior-that help security analysts detect the presence of malicious activity. According to ISO/IEC 27035-2:2016 and supported by ISO/IEC
27043:2015, IOCs are used in the detection, containment, and analysis phases of incident handling.
Their primary role is to uncover evidence of malicious activity by:
Matching known patterns to suspected compromise
Supporting threat hunting and detection rules
Enabling faster identification of affected systems
While IOCs can support forensic analysis (Option A), their main purpose is to identify malicious behavior.
Option B (assessing isolation measures) may be influenced by IOCs but is not their primary function.
Reference:
ISO/IEC 27035-2:2016, Clause 6.3.4: "Indicators of compromise (IOCs) are useful for identifying systems affected by malicious activity and guiding response actions." ISO/IEC 27043:2015, Clause 7.3.2: "IOCs serve as markers for identifying threats and understanding attack vectors." Correct answer: C
-