A SOC team wants to detect a known malware that uses a specific user-agent string in its HTTP requests. The team wants to implement detection at the network layer. Which detection mechanism should they use?

SIEM correlation rule on proxy logs

How are IoCs typically used in a SIEM to enhance detection?

By creating correlation rules that match incoming events against known IoCs

By automatically patching vulnerabilities that are associated with the IoCs

By replacing the need for log collection and analysis

By providing a list of users to block from the network

A SOC team is reviewing a threat report that includes a file hash, a C2 domain, and a description of the attacker using a specific PowerShell command to enumerate Active Directory. The team wants to build a detection strategy that is resilient to the attacker changing their infrastructure. Which approach is most effective?

Create a behavioral rule that detects the PowerShell command pattern

Use the file hash to create an antivirus signature and the domain for IDS alerts

Block the C2 domain at the DNS level and rely on the file hash for endpoint detection

Create a SIEM rule for the file hash and a firewall rule for the C2 domain

EC-CouncilCertified SOC Analyst

Domain 2Objective 2

Indicators of Compromise (IoCs) CSA Practice Questions (Page 4)

Part of the Cyber Threats and Attack Methodology domain, which makes up ~21% of our current practice bank.

45questions here

9free pages

10concepts

Questions 16–20

16application · medium
A SOC team wants to detect a known malware that uses a specific user-agent string in its HTTP requests. The team wants to implement detection at the network layer. Which detection mechanism should they use?
Select an answer first
17application · medium
A SOC team is evaluating a new threat intelligence feed. The feed provides a list of file hashes and domains. The team wants to assess the feed's quality before integrating it into their SIEM. Which factor is most important to evaluate?
Select an answer first
18foundation · easy
How are IoCs typically used in a SIEM to enhance detection?
Select an answer first
19expert · hard
A SOC team is reviewing a threat report that includes a file hash, a C2 domain, and a description of the attacker using a specific PowerShell command to enumerate Active Directory. The team wants to build a detection strategy that is resilient to the attacker changing their infrastructure. Which approach is most effective?
Select an answer first
20application · medium
An analyst is mapping observed indicators to the Cyber Kill Chain. The analyst sees a suspicious outbound connection to an IP address that is known to be a command-and-control server. Which stage of the kill chain does this IoC most directly indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Indicators of Compromise (IoCs) CSA Practice Questions (Page 4)

Questions 16–20

A SOC team wants to detect a known malware that uses a specific user-agent string in its HTTP requests. The team wants to implement detection at the network layer. Which detection mechanism should they use?

A SOC team is evaluating a new threat intelligence feed. The feed provides a list of file hashes and domains. The team wants to assess the feed's quality before integrating it into their SIEM. Which factor is most important to evaluate?

How are IoCs typically used in a SIEM to enhance detection?

An analyst is mapping observed indicators to the Cyber Kill Chain. The analyst sees a suspicious outbound connection to an IP address that is known to be a command-and-control server. Which stage of the kill chain does this IoC most directly indicate?

Keep studying — Cyber Threats and Attack Methodology