5.5 Identify Indicators of Attack (IOAs), Rogue Containers and Drift CCCS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security analyst notices a container that is running with a process that is attempting to escalate privileges. The container was not part of the original deployment. Which of the following is the most appropriate immediate response?

   • ADelete the container immediately without further investigation.
   • BIsolate the container and investigate the process behavior.
   • CRestart the container to clear the process.
   • DIgnore the alert and continue monitoring the container.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security engineer is tasked with detecting container drift in a high-availability production environment. The engineer must minimize false positives while ensuring that any drift is detected quickly. The environment has a mix of stateless and stateful containers, and some containers legitimately write to their filesystems. Which approach best balances these requirements?

   • AImplement file integrity monitoring that compares critical files to the image baseline, with an allowlist for known writable paths
   • BUse process monitoring to detect new processes that are not in the image's process list
   • CCompare the container's network connections to a baseline
   • DMonitor all filesystem changes and alert on any modification
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security operations center receives an alert that a container is attempting to write to a file outside its allowed directory. The file path is not a known IOC, but the behavior is unusual for the application. Which type of indicator does this represent?

   • AContainer drift
   • BIndicator of attack (IOA)
   • CRogue container
   • DIndicator of compromise (IOC)
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the context of runtime protection, what distinguishes an Indicator of Attack (IOA) from an Indicator of Compromise (IOC)?

   • AIOAs focus on the intent and sequence of actions leading to an attack, while IOCs are forensic evidence left after a compromise.
   • BIOAs are based on known malware signatures, while IOCs are based on behavioral patterns.
   • CIOAs are only detected in cloud environments, while IOCs are only detected in on-premises environments.
   • DIOAs are static indicators, while IOCs are dynamic and change over time.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst at a financial firm is reviewing runtime alerts from a containerized trading application. The alerts show a process spawning a shell from within a container that normally runs a statically compiled binary, followed by an outbound connection to an IP address not on any allowlist. The analyst needs to classify this activity for the incident response report. Which classification is most accurate?

   • AIndicators of compromise (IOCs) because the IP address is a known malicious artifact.
   • BIndicators of attack (IOAs) because the sequence of process behavior and network connection suggests an active attack.
   • CContainer drift because the container deviated from its original image configuration.
   • DRogue container because the container is running unauthorized software.
   Reveal Solution Discussion Select an answer first