3.7 Determine IOCs in a Sandbox Environment (includes Generating Complex Indicators) 350-201 Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   A sandbox report shows a malware sample that downloads a payload from a URL, but the URL is not on any threat intelligence feed. The analyst also notices that the payload file hash matches a known malware family. What is the best way to validate the URL as an IOC?

   • ACorrelate the URL with the payload hash and search for the URL in other sandbox reports or threat intelligence sources.
   • BIgnore the URL because it is not on any threat intelligence feed.
   • CBlock the URL immediately because it was used to download malware.
   • DUse the URL as a standalone IOC because it was observed in the sandbox.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A malware sample is observed in the sandbox to use a legitimate Windows utility (e.g., PowerShell) to download a payload and then execute it in memory without writing to disk. The analyst wants to create an IOC that detects this behavior on endpoints. Which approach is most effective?

   • AAlert when a file is downloaded by any process
   • BAlert when any process executes code in memory
   • CAlert when PowerShell is used to download a file from the internet
   • DAlert when PowerShell downloads a file and then executes it in memory, especially if the download URL is not in the allowlist
   Reveal Solution Discussion Select an answer first
3. 38foundation · easy

   What is a complex indicator in the context of IOC generation?

   • AA file hash that is unique to a specific malware sample
   • BA single IP address that is known to be malicious
   • CA combination of multiple simple IOCs, such as a file hash that connects to a specific domain and creates a registry key
   • DA domain name that is newly registered
   Reveal Solution Discussion Select an answer first