3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC has implemented a new behavioral analytics rule that flags any user who logs in from more than one country within an hour. The rule generates a high volume of alerts, many of which turn out to be legitimate travelers using VPNs. What is the primary challenge the SOC is experiencing?

   • AThe rule is too specific and misses real attacks
   • BHigh false positive rate due to the broad nature of the IOA rule
   • CInsufficient IOC coverage for known malware
   • DLack of threat intelligence feeds
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An organization has been hit by a ransomware variant that is a modified version of a known family. The existing IOC database contains hashes of the original family but not the modified variant. The security team wants to improve detection for future variants. Which approach is most effective?

   • AUpdate the IOC database with the new hash and continue using IOC matching
   • BRely on the original IOC hashes because variants share the same hash
   • CBlock all executable files from running
   • DUse behavioral analytics to detect ransomware-like activity, such as mass file encryption
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations center (SOC) receives a threat intelligence feed containing a list of known malicious SHA256 hashes, domains, and IP addresses. The SOC wants to detect whether any of these indicators are present in the environment. Which approach would most directly accomplish this?

   • ADeploy a honeypot to attract attackers
   • BReview firewall rules for misconfigurations
   • CAnalyze user login patterns for anomalies
   • DSearch endpoint files, DNS logs, and network flows for matches against the feed
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which statement best defines an Indicator of Compromise (IOC)?

   • AA pattern of behavior that suggests an attack is currently in progress
   • BA vulnerability in a system that could be exploited by an attacker
   • CA forensic artifact that indicates a system may have been compromised
   • DA real-time alert generated by an intrusion detection system
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why might an attacker easily evade detection that relies only on IOCs?

   • ABecause IOCs are based on static artifacts that can be changed or obfuscated
   • BBecause IOCs require real-time analysis of user behavior
   • CBecause IOCs are too complex for most security tools to process
   • DBecause IOCs are only available from government sources
   Reveal Solution Discussion Select an answer first