Which of the following is a common source for gathering Indicators of Compromise (IoCs)?

The organization's marketing campaign analytics

The company's employee handbook

Threat intelligence feeds from commercial vendors

The organization's annual budget report

A SOC analyst is analyzing an IoC that is a domain name. The analyst wants to determine if the domain is malicious. Which additional information would be most useful for this analysis?

The domain's web server software

The domain's age and registration details

The domain's SSL certificate issuer

What is a common limitation of IoCs?

They are always accurate and rarely produce false positives

They are only applicable to network-based attacks

They are only useful for detecting known threats

They are too complex for most security analysts to understand

Which of the following is an example of a file-based Indicator of Compromise (IoC)?

A suspicious IP address that repeatedly connects to an internal server

An email subject line used in a phishing campaign

The MD5 hash of a known malware executable

A domain name that is associated with a command-and-control server

A SOC analyst is reviewing a threat intelligence report about a new ransomware family. The report lists the file hash of the ransomware binary, the C2 domain it uses, and a description of how it uses scheduled tasks for persistence. The analyst needs to configure immediate detection for this threat. Which item from the report should the analyst prioritize for a SIEM detection rule?

The persistence technique description

EC-CouncilCertified SOC Analyst

Domain 2Objective 2

Indicators of Compromise (IoCs) CSA Practice Questions (Page 1)

Part of the Cyber Threats and Attack Methodology domain, which makes up ~21% of our current practice bank.

45questions here

9free pages

10concepts

Questions 1–5

1foundation · easy
Which of the following is a common source for gathering Indicators of Compromise (IoCs)?
Select an answer first
2application · medium
A SOC analyst is analyzing an IoC that is a domain name. The analyst wants to determine if the domain is malicious. Which additional information would be most useful for this analysis?
Select an answer first
3foundation · easy
What is a common limitation of IoCs?
Select an answer first
4foundation · easy
Which of the following is an example of a file-based Indicator of Compromise (IoC)?
Select an answer first
5application · medium
A SOC analyst is reviewing a threat intelligence report about a new ransomware family. The report lists the file hash of the ransomware binary, the C2 domain it uses, and a description of how it uses scheduled tasks for persistence. The analyst needs to configure immediate detection for this threat. Which item from the report should the analyst prioritize for a SIEM detection rule?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.