CompTIA CySA+ (CS0-003) — Question 229

An analyst would like to start automatically ingesting IoCs into the EDR tool. Which of the following sources would be the most cost effective for the analyst to use?

Answer options

• A. Government bulletins
• B. Social media
• C. Dark web
• D. Blogs

Correct answer: A

Explanation

Government bulletins are typically free and provide reliable, authoritative information on IoCs, making them the most cost-effective source. In contrast, social media, the dark web, and blogs may require subscriptions or extensive monitoring efforts, which can incur additional costs.