3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC analyst is investigating an alert where a user account logged in from a new location and then attempted to access a high-value server. The login IP is not on any threat intelligence list, but the access attempt is unusual for this user. The analyst must decide whether to escalate the alert. Which action is most appropriate?

   • AEscalate the alert because the behavioral pattern suggests a potential attack, even without an IOC match
   • BClose the alert because the IP is not on any threat list
   • CWait for more IOCs to appear before escalating
   • DEscalate only if the user has administrative privileges
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   A security tool is configured to alert when a file on an endpoint matches a known malware hash. Which detection method is being used?

   • AVulnerability scanning
   • BBehavioral analysis
   • CAnomaly detection
   • DIndicator of Compromise (IOC) matching
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A small business has no dedicated security team and wants to start detecting both known malware and active attack behaviors. Which combination of sources would provide the most comprehensive coverage for both IOCs and IOAs?

   • AOnly firewall logs for IOAs.
   • BA commercial threat intelligence feed for IOCs and a SIEM with behavioral rules for IOAs.
   • CIncident response reports from other companies for both IOCs and IOAs.
   • DOnly open-source threat intelligence feeds for IOCs.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is a common source for obtaining Indicators of Compromise (IOCs) and Indicators of Attack (IOAs)?

   • AVendor marketing materials
   • BUser password policies
   • CThreat intelligence feeds
   • DNetwork topology diagrams
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security team is building a detection program from scratch with a limited budget. The team needs to detect both known malware and insider threats. Which combination of sources provides the most cost-effective coverage?

   • AOnly authentication logs
   • BCommercial threat intelligence feeds and a new SIEM platform
   • COnly open-source threat intelligence feeds
   • DOpen-source threat intelligence feeds and existing authentication and file-access logs
   Reveal Solution Discussion Select an answer first