3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security team wants to improve its detection of both known malware and novel attack techniques. The team has limited analyst time and wants to reduce false positives. Which strategy best balances IOC and IOA usage?

   • AUse IOC matching only for high-value assets and ignore IOAs
   • BRely exclusively on IOC matching because it is more accurate
   • CUse IOC matching for known threats and IOA analytics for behavioral anomalies, then correlate the results
   • DRely exclusively on IOA analytics because it catches new attacks
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   An analyst discovers a file hash that matches a known malware sample on an endpoint. In the context of threat detection, how is this file hash best classified?

   • AAn Indicator of Attack (IOA)
   • BA Common Vulnerability and Exposure (CVE)
   • CA security control
   • DAn Indicator of Compromise (IOC)
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a common limitation of using Indicators of Attack (IOAs) for threat detection?

   • AThey can generate a high number of false positives
   • BThey are static and easily evaded by attackers
   • CThey are only useful after a compromise has been confirmed
   • DThey require no analysis because they are simple artifacts
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   An analyst is reviewing a list of known malicious indicators to check against endpoint data. Which item would be considered an IOC?

   • AAn unusual pattern of failed logins
   • BA sudden increase in network traffic
   • CA registry key associated with malware persistence
   • DA sequence of commands executed by an attacker
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security team needs to build a detection capability for a new campaign that uses a unique domain and a specific privilege escalation technique. The team has access to a commercial threat intelligence feed, internal security logs, and incident response reports from other organizations. Which combination of sources would provide the most complete and actionable intelligence for both IOCs and IOAs?

   • AUse only the incident response reports from other organizations.
   • BUse only internal security logs for both the domain and the privilege escalation technique.
   • CUse the threat intelligence feed for the domain and internal security logs for privilege escalation patterns.
   • DUse only the threat intelligence feed for both the domain and the privilege escalation technique.
   Reveal Solution Discussion Select an answer first