A security analyst notices that an IOC for a specific malware family is no longer generating any alerts in the SIEM. The malware has not been seen in the environment for several months. What should the analyst do with this IOC?

Remove it from the detection list

Which of the following is a file-based indicator of compromise (IOC)?

SHA-256 hash of a malicious executable

Registry key that enables persistence

IP address of a command-and-control server

Unusual outbound traffic pattern

During a compromise assessment, an analyst finds a new Windows service that is set to start automatically. The service executable is located in a temporary directory and has a valid digital signature from a reputable vendor. Which IOC type is most relevant, and what is the best next step?

Network-based IOC (temp directory) - block the directory

Host-based IOC (service) - investigate the service executable further

File-based IOC (signature) - ignore the service because the signature is valid

Behavioral IOC (auto-start) - no action needed because auto-start is common

Palo Alto NetworksCertified Cybersecurity Practitioner

Domain 5Objective 1

5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Part of the Endpoint Security domain, which accounts for 15% of the CYBERSECURITY-PRACTITIONER exam.

36questions here

8free pages

9concepts

15%of the exam

Questions 16–20

16foundation · easy
Which of the following is a common type of Indicator of Compromise (IOC)?
Select an answer first
17application · medium
A security analyst notices that an IOC for a specific malware family is no longer generating any alerts in the SIEM. The malware has not been seen in the environment for several months. What should the analyst do with this IOC?
Select an answer first
18foundation · easy
Which of the following is a file-based indicator of compromise (IOC)?
Select an answer first
19foundation · easy
Which of the following is a valid source for obtaining IOCs?
Select an answer first
20expert · hard
During a compromise assessment, an analyst finds a new Windows service that is set to start automatically. The service executable is located in a temporary directory and has a valid digital signature from a reputable vendor. Which IOC type is most relevant, and what is the best next step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CYBERSECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.

5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

Which of the following is a common type of Indicator of Compromise (IOC)?

A security analyst notices that an IOC for a specific malware family is no longer generating any alerts in the SIEM. The malware has not been seen in the environment for several months. What should the analyst do with this IOC?

Which of the following is a file-based indicator of compromise (IOC)?

Which of the following is a valid source for obtaining IOCs?

During a compromise assessment, an analyst finds a new Windows service that is set to start automatically. The service executable is located in a temporary directory and has a valid digital signature from a reputable vendor. Which IOC type is most relevant, and what is the best next step?

Keep studying — Endpoint Security