A security analyst is analyzing a polymorphic malware sample in a sandbox. The malware generates a new hash each time it runs, but it consistently creates a mutex named 'Global\MS-3X9' and connects to a domain that changes every 24 hours. The analyst wants to create a detection rule that will remain effective over time. Which approach is most appropriate?

Create a complex indicator that combines the mutex name with the domain pattern and behavioral actions

Use the file hash as the primary IOC, since it is unique to each sample

Use the mutex name as the primary IOC, since it is consistent across variants

Use the domain as the primary IOC, since it changes daily

Which of the following best represents a complex indicator?

The MD5 hash of a known malware executable

The IP address of a command-and-control server

A behavioral pattern where a process creates a file, modifies a registry key, and then attempts a network connection to a known malicious domain

The name of a malicious file, such as 'malware.exe'

A malware sample creates a scheduled task that runs a PowerShell script every 15 minutes. The script contacts a unique domain that changes each time. Which sandbox observation is most useful for creating a detection rule?

The scheduled task name and the PowerShell script's file path

The parent process ID of the PowerShell process

The unique domain observed in the first network connection

The total number of network connections made during the sandbox run

A sandbox report for a worm shows that it copies itself to multiple network shares and modifies the hosts file to redirect a known domain. Which IOC is most useful for detecting the worm on other systems?

The number of network shares it copies to

The modification to the hosts file, specifically the added entry

The file name of the worm's copy

The name of the network share it copies itself to

A sandbox report shows a binary attempting to resolve a domain that is not yet flagged by the organization's threat intelligence feed. The analyst checks the domain's WHOIS record and finds it was registered three days ago. The binary also drops a file with a hash that matches a known malware family in the feed. What should the analyst do to validate and enrich the domain as an IOC?

Report the domain as a false positive because it is not in the feed

Correlate the domain with the file hash and check the threat intelligence feed for any related campaigns or infrastructure

Add the domain to the blocklist immediately based on the sandbox behavior

Ignore the domain because it is not in the threat intelligence feed

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 7

3.7 Determine IOCs in a Sandbox Environment (includes Generating Complex Indicators) 350-201 Practice Questions (Page 3)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

30%of the exam

Questions 11–15

11expert · hard
A security analyst is analyzing a polymorphic malware sample in a sandbox. The malware generates a new hash each time it runs, but it consistently creates a mutex named 'Global\MS-3X9' and connects to a domain that changes every 24 hours. The analyst wants to create a detection rule that will remain effective over time. Which approach is most appropriate?
Select an answer first
12foundation · easy
Which of the following best represents a complex indicator?
Select an answer first
13application · medium
A malware sample creates a scheduled task that runs a PowerShell script every 15 minutes. The script contacts a unique domain that changes each time. Which sandbox observation is most useful for creating a detection rule?
Select an answer first
14application · medium
A sandbox report for a worm shows that it copies itself to multiple network shares and modifies the hosts file to redirect a known domain. Which IOC is most useful for detecting the worm on other systems?
Select an answer first
15application · medium
A sandbox report shows a binary attempting to resolve a domain that is not yet flagged by the organization's threat intelligence feed. The analyst checks the domain's WHOIS record and finds it was registered three days ago. The binary also drops a file with a hash that matches a known malware family in the feed. What should the analyst do to validate and enrich the domain as an IOC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

3.7 Determine IOCs in a Sandbox Environment (includes Generating Complex Indicators) 350-201 Practice Questions (Page 3)

Questions 11–15

Which of the following best represents a complex indicator?

A malware sample creates a scheduled task that runs a PowerShell script every 15 minutes. The script contacts a unique domain that changes each time. Which sandbox observation is most useful for creating a detection rule?

A sandbox report for a worm shows that it copies itself to multiple network shares and modifies the hosts file to redirect a known domain. Which IOC is most useful for detecting the worm on other systems?

Keep studying — Processes