During incident response, a SOC analyst has identified a set of IoCs, including a malicious domain and a file hash. The incident response team needs to contain the threat. Which action should the analyst take first?

Delete the malicious file from all endpoints

Notify the users who may have been affected

Block the malicious domain at the firewall

Conduct a full forensic analysis of the affected systems

A SOC analyst is investigating a potential malware infection on a user's workstation. The analyst needs to collect IoCs from the endpoint to determine the scope of the infection. Which data source would provide the most direct evidence of the malware's execution and persistence?

Endpoint process and registry logs

How can IoCs be used during the containment phase of incident response?

To update the incident response plan for future incidents

To identify all systems that need to be isolated from the network

To determine the root cause of the incident

To restore systems from backups

Which of the following IoCs is most commonly associated with the 'Command and Control' stage of the cyber kill chain?

An email subject line used in a phishing campaign

A domain name that resolves to a known C2 server

A registry key modification on the victim's system

A file hash of a malicious executable

A SOC analyst is configuring an IDS with a list of malicious IP addresses from a threat feed. After a week, the analyst notices a high number of alerts, but most are false positives. What is the most likely reason for this?

The IDS is configured with too few signatures

The IP addresses are from a dynamic pool used by both malicious and benign actors

The IDS is placed on the wrong network segment

EC-CouncilCertified SOC Analyst

Domain 2Objective 2

Indicators of Compromise (IoCs) CSA Practice Questions (Page 6)

Part of the Cyber Threats and Attack Methodology domain, which makes up ~21% of our current practice bank.

45questions here

9free pages

10concepts

Questions 26–30

26application · medium
During incident response, a SOC analyst has identified a set of IoCs, including a malicious domain and a file hash. The incident response team needs to contain the threat. Which action should the analyst take first?
Select an answer first
27application · medium
A SOC analyst is investigating a potential malware infection on a user's workstation. The analyst needs to collect IoCs from the endpoint to determine the scope of the infection. Which data source would provide the most direct evidence of the malware's execution and persistence?
Select an answer first
28foundation · easy
How can IoCs be used during the containment phase of incident response?
Select an answer first
29foundation · easy
Which of the following IoCs is most commonly associated with the 'Command and Control' stage of the cyber kill chain?
Select an answer first
30application · medium
A SOC analyst is configuring an IDS with a list of malicious IP addresses from a threat feed. After a week, the analyst notices a high number of alerts, but most are false positives. What is the most likely reason for this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.