A security team relies solely on file hash IOCs to detect malware. A new malware variant is detected in the wild, but the team's tools do not flag it. What is the most likely reason for this gap?

The malware uses a different file name

The hash is not in the public repository

The malware variant has a different hash

Which of the following is a behavioral indicator of compromise (IOC)?

A user account suddenly gaining administrator privileges

A file hash that matches a known malware sample

A registry key that adds a startup entry

An IP address that is on a threat intelligence blocklist

Palo Alto NetworksCertified Cybersecurity Practitioner

Domain 5Objective 1

5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Part of the Endpoint Security domain, which accounts for 15% of the CYBERSECURITY-PRACTITIONER exam.

36questions here

8free pages

9concepts

15%of the exam

Questions 6–10

6application · medium
A security team relies solely on file hash IOCs to detect malware. A new malware variant is detected in the wild, but the team's tools do not flag it. What is the most likely reason for this gap?
Select an answer first
7application · medium
A security team wants to proactively block known malicious domains and IPs in their firewall. They need a source that is continuously updated with the latest threat intelligence. Which source should they use?
Select an answer first
8foundation · easy
Which of the following is a behavioral indicator of compromise (IOC)?
Select an answer first
9application · medium
A SOC analyst notices a workstation making repeated connections to an external IP address at odd hours. The traffic pattern is consistent and occurs every 15 minutes. Which IOC type best describes this finding?
Select an answer first
10application · medium
During incident response, an analyst discovers a new registry entry that runs a script at every system startup. This entry was not present in the baseline. Which IOC type does this finding represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CYBERSECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.

5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

A security team relies solely on file hash IOCs to detect malware. A new malware variant is detected in the wild, but the team's tools do not flag it. What is the most likely reason for this gap?

A security team wants to proactively block known malicious domains and IPs in their firewall. They need a source that is continuously updated with the latest threat intelligence. Which source should they use?

Which of the following is a behavioral indicator of compromise (IOC)?

A SOC analyst notices a workstation making repeated connections to an external IP address at odd hours. The traffic pattern is consistent and occurs every 15 minutes. Which IOC type best describes this finding?

During incident response, an analyst discovers a new registry entry that runs a script at every system startup. This entry was not present in the baseline. Which IOC type does this finding represent?

Keep studying — Endpoint Security