3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A security analyst observes a user account attempting to access multiple systems in a short period, followed by a failed attempt to escalate privileges. How would this behavior be categorized?

   • AAn Indicator of Attack (IOA)
   • BAn Indicator of Compromise (IOC)
   • CA false positive
   • DA vulnerability
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A security team detects a known malicious file hash (IOC) on a host and also observes the host making connections to multiple internal systems (IOA). How does correlating these indicators help the team?

   • AIt proves the file hash is a false positive
   • BIt indicates the attack is over and no further action is needed
   • CIt eliminates the need to isolate the host
   • DIt confirms the host is compromised and suggests the attacker is actively moving laterally
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security architect is designing a detection strategy for a network that has experienced a previous breach. The architect wants to detect both remnants of the past breach and any new attack activity. Which approach best addresses both goals?

   • ADeploy IOC matching for known artifacts from the breach and behavioral analytics for new attack patterns
   • BUse threat intelligence feeds exclusively
   • CDeploy only IOC matching for the known artifacts
   • DDeploy only behavioral analytics for new patterns
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing alerts from a hospital's network. The SIEM shows a single failed login for a radiology technician account at 3:00 AM, followed by a successful login from the same account at 3:01 AM from a workstation in the cardiology department. The analyst also finds a known malware hash in a file on that workstation. Which combination best represents an Indicator of Attack (IOA) versus an Indicator of Compromise (IOC)?

   • ABoth the login pattern and the malware hash are IOCs because they are evidence of past activity.
   • BThe failed-then-successful login pattern is the IOA; the malware hash is the IOC.
   • CBoth the login pattern and the malware hash are IOAs because they indicate attacker intent.
   • DThe malware hash is the IOA; the failed login is the IOC.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is analyzing IOAs often more complex than analyzing IOCs?

   • ABecause IOAs are only available from classified sources
   • BBecause IOAs require understanding the sequence and context of actions
   • CBecause IOAs are simple static values that are easy to match
   • DBecause IOAs are always false positives
   Reveal Solution Discussion Select an answer first