Indicators of Compromise (IoCs) CSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why do IoCs have a short lifespan in many cases?

   • AIoCs are only valid for the specific organization that discovered them
   • BAttackers frequently change their infrastructure and tools to avoid detection
   • CIoCs are automatically deleted from threat intelligence feeds after a week
   • DIoCs are too large to store for extended periods
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is reviewing a threat intelligence report that describes a new attack campaign. The report includes the following: a malicious IP address, a file hash, and a description of the attacker using PowerShell to download and execute the payload. The analyst wants to create a detection rule that will remain effective even if the attacker changes the IP and file hash. Which part of the report should the analyst focus on?

   • AThe file hash
   • BThe PowerShell technique
   • CThe report's publication date
   • DThe malicious IP address
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   During incident response, a SOC team identifies a file hash and a C2 domain as IoCs. The team needs to eradicate the threat from the environment. Which action is most appropriate for eradication?

   • AAdd the file hash to the SIEM rule for future detection.
   • BNotify the organization's management and legal team.
   • CRemove the malicious files from affected systems and revoke the C2 domain's access at the firewall.
   • DQuarantine the affected systems and monitor for further activity.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How can sandbox analysis contribute to the collection of Indicators of Compromise (IoCs)?

   • ABy scanning the entire network for vulnerabilities and generating a risk score
   • BBy collecting email metadata from phishing campaigns to identify sender addresses
   • CBy providing a safe environment to execute suspicious files and observe their behavior, which can reveal IoCs
   • DBy analyzing DNS traffic to identify domain names used by malware
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of an Indicator of Compromise (IoC) in a security operations context?

   • ATo define the steps an attacker takes to achieve a specific objective during an attack
   • BTo provide a unique identifier for a specific vulnerability in a software product
   • CTo act as a digital artifact observed on a system or network that suggests a security incident may have occurred
   • DTo serve as a piece of forensic evidence that can be used in legal proceedings against an attacker
   Reveal Solution Discussion Select an answer first