Indicators of Compromise (IoCs) CSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   During which phase of incident response are IoCs most commonly used to identify affected systems?

   • ARecovery
   • BContainment
   • CEradication
   • DTriage and identification
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC team wants to detect a known malware campaign that uses a specific domain for C2 and a specific file hash for the dropper. They want to implement detection at multiple layers. Which combination of detection mechanisms would provide the most comprehensive coverage?

   • AEmail gateway filter for the domain
   • BOnly a SIEM rule for the file hash
   • COnly an IDS signature for the domain
   • DSIEM rule for the file hash and IDS signature for the domain
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC team is implementing detection for a new malware campaign. The campaign uses a unique file hash for the initial dropper, a domain for C2, and a specific pattern of DNS queries. The team wants to minimize false positives while maximizing detection. Which approach is most effective?

   • ACreate a rule that alerts on the file hash only
   • BCreate a rule that alerts on the DNS pattern only
   • CCreate a SIEM rule that alerts on the file hash and the DNS query pattern together
   • DCreate separate rules for the file hash and the DNS pattern
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a common way to use IoCs in an IDS/IPS?

   • ABy updating the signature database with rules that detect traffic matching the IoCs
   • BBy using IoCs to replace the need for network monitoring
   • CBy configuring the IDS/IPS to automatically block all traffic from the organization's internal network
   • DBy using IoCs to generate weekly reports for management
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC team is building a threat intelligence program and wants to collect IoCs from multiple sources. They have access to a commercial threat intelligence feed, internal incident reports, and a sandbox environment. The team wants to prioritize IoCs that are most relevant to their organization. Which approach should they take?

   • AUse only sandbox analysis because it provides the most detail
   • BCorrelate IoCs from all three sources and prioritize those that appear in multiple sources
   • CUse only the commercial feed because it is the most comprehensive
   • DUse only internal incident reports because they are most relevant
   Reveal Solution Discussion Select an answer first