Which option does IOA stand for?

• A. Indicators of Compromise
• B. Indicators of Access
• C. Indicators of Anomaly
• D. Indicators of Attack

Answer: (D)

In security monitoring, Indicators of Attack describe signals that point to attacker behavior and techniques in progress. They focus on suspicious activity patterns, such as unusual process creation, privilege escalation attempts, or lateral movement, that suggest someone is actively trying to breach or move within a system. This allows defenders to detect and interrupt an attack earlier, before data is exfiltrated or systems are fully compromised.

Indicators of Compromise, by contrast, are artifacts left behind after a breach has occurred—things like known-malicious file hashes, IP addresses, domain names, or registry keys. They’re useful for identifying systems that have already been compromised, but they don’t necessarily indicate ongoing attack activity.

The other options aren’t standard terms in this context. Indicators of Access or Indicators of Anomaly are not the commonly used phrases for describing attacker-focused signals. So the best answer is Indicators of Attack, since it captures the idea of detecting the attacker’s methods and objectives in real time.