5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is triaging a suspicious file found on an endpoint. The file has a known name and size, but the analyst needs to confirm it matches a known malware sample. Which file-based IOC provides the most reliable confirmation?

   • AFile path
   • BSHA-256 hash
   • CFile size
   • DFile name
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a host-based indicator of compromise (IOC)?

   • AA new service that starts automatically and is not recognized
   • BAn IP address that appears in firewall logs
   • CA file hash that matches a known malware sample
   • DA URL that is accessed by multiple workstations
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An incident responder is analyzing a malware sample. The sample's SHA-256 hash is not found in any threat intelligence feed. However, the file name matches a known malware family and the file size is identical to a known sample. What should the responder conclude?

   • AThe file is a false positive and should be ignored
   • BThe file is likely a new variant or packed version of the known malware
   • CThe file is definitely the known malware because the name matches
   • DThe file is benign because the hash is not in the feed
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is reviewing a suspicious email attachment that was opened by a user. The analyst wants to determine if the file is known malware by checking its unique identifier against a threat intelligence feed. Which IOC type should the analyst extract from the file to perform this check?

   • AFile path
   • BIP address
   • CRegistry key
   • DFile hash (SHA-256)
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst is managing an IOC list in their SIEM. They notice that a particular IP address has been flagged as malicious for over a year, but recent threat intelligence shows the IP is now used by a legitimate service. The analyst wants to reduce false positives. What is the best course of action?

   • ARemove the IP from the IOC list
   • BReplace the IP with a domain name
   • CKeep the IP and increase the alert threshold
   • DIgnore the new intelligence
   Reveal Solution Discussion Select an answer first