3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An organization's security team relies heavily on IOC matching for detection. A recent attack used a legitimate system tool to perform malicious actions, and the tool's hash was not flagged as malicious. Why did the IOC-based detection fail?

   • AThe IOC list was not updated frequently enough
   • BThe IOC list did not include the legitimate tool's hash because it is not inherently malicious
   • CThe IOC matching engine was misconfigured
   • DThe attack did not leave any IOCs
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst notices that a service account is logging in from multiple geographic locations within a short time window, followed by attempts to access sensitive file shares. The analyst needs to determine whether this is an ongoing attack. Which type of indicator is most relevant to this analysis?

   • AIndicators of Compromise (IOCs), because the account is compromised
   • BBoth equally, because any login anomaly is both an IOC and an IOA
   • CIndicators of Attack (IOAs), because the login pattern and access attempts suggest active malicious behavior
   • DNeither, because the analyst needs a file hash to confirm an attack
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst notices a series of events: a standard user account attempts to enumerate Active Directory groups, then tries to access a file share containing payroll data, and finally executes a PowerShell script that creates a new local admin account. Which type of detection is best suited to identify this as a potential attack?

   • AReviewing firewall logs for connections to known malicious IP addresses.
   • BBehavioral analytics that flags sequences of actions matching known attack patterns.
   • CSignature-based detection on network traffic for known exploit payloads.
   • DHash matching against a threat intelligence feed of known malware files.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An incident response team is compiling a list of indicators from a recent breach. Which source would provide the most direct evidence of attacker behavior during the incident?

   • AIndustry news articles
   • BVendor patch notes
   • CEmployee training slides
   • DSecurity logs
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which statement best describes an Indicator of Attack (IOA)?

   • AA pattern of actions that suggests an attacker is currently attempting to compromise a system
   • BA log entry that records a successful user login
   • CA static artifact such as a malicious file hash or domain name
   • DA vulnerability scanner report listing missing patches
   Reveal Solution Discussion Select an answer first