3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is building a detection strategy for a new environment. The analyst wants to include both known-bad indicators and behavioral rules. Which set of sources would provide the necessary data for both?

   • AAntivirus definitions for IOCs and DNS logs for IOAs
   • BVulnerability scanner reports for IOCs and firewall logs for IOAs
   • CIncident response reports for IOCs and threat intelligence feeds for IOAs
   • DThreat intelligence feeds for IOCs and authentication logs for IOAs
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A small security team needs to improve its detection capabilities without adding new hardware. The team wants to leverage external knowledge about known threats and also analyze its own environment for suspicious behavior. Which combination of sources would best support both IOC-based and IOA-based detection?

   • ASubscribe to a commercial threat intelligence feed and enable logging on existing endpoints and servers
   • BOnly use open-source intelligence from social media
   • CRely solely on antivirus signatures
   • DDeploy a new SIEM and hire additional analysts
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During an incident, the SIEM shows a known malicious domain being contacted by an internal host. At the same time, the EDR reports that the host is executing a series of unusual PowerShell commands. How should the analyst use this information?

   • AIsolate the host immediately without further analysis.
   • BCorrelate the domain contact with the PowerShell activity to confirm the host is compromised and determine the attack's scope.
   • CBlock the domain and consider the incident resolved.
   • DIgnore the PowerShell activity because the domain is the only confirmed IOC.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a key limitation of relying solely on Indicators of Compromise (IOCs) for threat detection?

   • AThey are proactive and can predict future attacks
   • BThey require complex behavioral analysis
   • CThey generate too many false positives
   • DThey are reactive and can be evaded by attackers using novel techniques
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst sees an alert for a known malicious IP address in the firewall logs. At the same time, the SIEM shows a user account making unusual lateral movement attempts. How should the analyst use this information to improve detection?

   • AIgnore the lateral movement because the IP address is the only confirmed IOC.
   • BCorrelate the IP address with the lateral movement pattern to confirm the attack and identify the affected host.
   • CTreat the lateral movement as a false positive because the IP is known.
   • DBlock the IP address and consider the incident closed.
   Reveal Solution Discussion Select an answer first