5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a host-based IOC?

   • AA scheduled task that runs a PowerShell script
   • BA network connection to an unusual port
   • CA domain name that resolves to a known malicious IP
   • DA file size that is unusually large for its type
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A threat intelligence team publishes an IOC for a new malware campaign. The IOC is a domain name that is used for command-and-control. After two weeks, the domain is taken down by the registrar. What should the team do with the IOC?

   • AIncrease the priority of the IOC
   • BRemove the IOC immediately
   • CKeep the IOC but mark it as inactive
   • DReplace the domain with the IP address
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What does the 'decay' of an IOC refer to?

   • AThe indicator being replaced by a new one every day
   • BThe indicator being automatically deleted from the system
   • CThe indicator becoming less useful over time as attackers change their methods
   • DThe indicator being corrupted by malware
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A small security team wants to improve their detection capabilities without a large budget. They need a source of IOCs that is freely accessible and can be integrated into their open-source SIEM. Which source is most appropriate?

   • ACommercial threat intelligence feeds
   • BMalware analysis reports
   • CIncident response findings
   • DPublic repositories
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a file-based IOC?

   • AA file name that matches a known malware signature
   • BA scheduled task that runs a malicious script
   • CA domain name used for phishing
   • DA process that consumes high CPU
   Reveal Solution Discussion Select an answer first