Indicators of Compromise (IoCs) CSA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC analyst is explaining to a junior analyst the role of IoCs in detecting security incidents. Which statement best describes the role of IoCs?

   • AIoCs are only used after an incident to determine the root cause.
   • BIoCs are always unique to a single attacker and cannot be shared.
   • CIoCs are forensic artifacts that indicate a system may have been compromised or is under attack.
   • DIoCs are the tactics and techniques used by attackers to achieve their objectives.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC analyst is reviewing a suspicious email reported by a user. The email contains an attachment with a SHA256 hash that matches a known malware sample, and the email's sending domain has been observed in recent phishing campaigns. The analyst needs to create a detection rule in the SIEM that will catch similar emails in the future. Which combination of IoCs should the analyst prioritize for the SIEM rule?

   • AThe attachment's SHA256 hash and the sending domain
   • BThe email's SPF and DKIM authentication results
   • CThe user's email address and the recipient's email address
   • DThe sender's display name and the email subject line
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   During an incident response, a SOC analyst identifies a file hash and a C2 domain as IoCs. The analyst needs to contain the threat quickly. Which action should the analyst take first?

   • ABlock the C2 domain at the firewall and add the file hash to the endpoint detection blocklist
   • BNotify the organization's management and legal team
   • CConduct a full forensic analysis of the affected endpoint
   • DWait for the threat intelligence feed to update with additional IoCs
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which factor is most important when determining the severity of an IoC?

   • AThe age of the IoC in the threat intelligence feed
   • BThe potential impact on the organization if the IoC is a true positive
   • CThe ease with which the IoC can be detected by existing security controls
   • DThe number of times the IoC has been seen in the wild
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A SOC team relies heavily on a commercial threat intelligence feed that provides IP addresses and domains. They have configured their SIEM to alert on any match with these IoCs. Recently, the team has been overwhelmed by alerts, many of which are false positives. The team suspects that the feed includes IoCs that are too broad. Which action would best reduce false positives while maintaining effective detection?

   • AIncrease the severity threshold for alerts so that only high-severity IoCs trigger alerts.
   • BBlock all IPs and domains from the feed at the firewall.
   • CDisable the feed and rely on internal detection rules.
   • DCorrelate the feed's IoCs with additional context, such as the presence of other indicators or specific behavior patterns, before generating an alert.
   Reveal Solution Discussion Select an answer first