3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security analyst is investigating a potential compromise. The SIEM shows a connection to a known malicious IP address, but the endpoint has no matching file hashes from the threat feed. The analyst suspects the malware may be a new variant. Which action would be most effective to confirm the compromise?

   • AConclude that the endpoint is not compromised because no known hash is present.
   • BCorrelate the IP connection with behavioral indicators such as unusual process execution or registry changes on the endpoint.
   • CBlock the IP address and close the investigation.
   • DSearch for other known IOCs such as domains and URLs.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   During incident response, an analyst collects evidence from a compromised host. The analyst finds a suspicious executable, a command-and-control domain in the hosts file, and a registry key that enables persistence. Which set of items are all examples of IOCs?

   • AFile hash of the executable, the domain, and the registry key
   • BThe domain, the registry key, and the number of failed logins
   • CThe file hash, the domain, and the user's privilege level
   • DThe user's login time, the executable's file size, and the registry key
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security analyst is investigating an alert where a known malicious IP address is communicating with an internal server. The SIEM also shows that the server is making unusual outbound connections to multiple internal hosts. The analyst must determine whether this is a coordinated attack. Which action would provide the strongest evidence?

   • AIsolate the internal server immediately.
   • BSearch for other IOCs on the internal server.
   • CCorrelate the timing of the outbound connections with the communication to the malicious IP.
   • DBlock the malicious IP and monitor for further connections.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company's threat intelligence feed provides a list of known malicious IP addresses and file hashes. The security team wants to detect whether any of these known threats have already affected their environment. Which approach would be most effective?

   • AReview incident response reports from other organizations for similar attack patterns.
   • BSearch proxy logs for connections to the listed IPs and scan endpoints for the listed file hashes.
   • CBlock all traffic to the listed IPs at the firewall without further analysis.
   • DMonitor user behavior for unusual login times and privilege escalation attempts.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An organization's SOC has a list of known malicious IP addresses and also observes a user account making repeated failed login attempts followed by a successful login from a foreign country. The SOC wants to improve detection accuracy. How should the SOC use these two pieces of information together?

   • ABlock the user account immediately without further analysis
   • BIgnore the IP list and focus only on the login pattern
   • CTreat the login pattern as a false positive because the IP is known
   • DCorrelate the failed login attempts with the known malicious IP list to prioritize the alert
   Reveal Solution Discussion Select an answer first