5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common source for obtaining Indicators of Compromise (IOCs)?

   • ANetwork configuration files
   • BSoftware license keys
   • CUser password hashes
   • DThreat intelligence feeds
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the most accurate definition of an Indicator of Compromise (IOC)?

   • AA vulnerability in software that could be exploited by an attacker
   • BA policy that defines acceptable use of an organization's IT resources
   • CA piece of forensic evidence that suggests a system or network may have been breached or is under attack
   • DA security control that prevents unauthorized access to a system
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following best describes the purpose of an Indicator of Compromise (IOC)?

   • ATo encrypt sensitive data at rest
   • BTo automatically patch vulnerabilities in software
   • CTo authenticate users accessing a network
   • DTo provide evidence that a system has been compromised or is being targeted by malicious activity
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team has implemented an EDR solution that relies on file hash IOCs and known malicious domains. A new malware campaign is observed in the wild, but the EDR does not detect it. The malware uses a unique domain per victim and modifies its code to change its hash. Which limitation of IOC-based detection is most evident?

   • AIOCs are reactive and can be evaded by polymorphic malware
   • BIOCs cannot be used in EDR solutions
   • CIOCs are not updated frequently enough
   • DIOCs are only available from commercial feeds
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network analyst observes a workstation sending a large volume of data to an external domain that is not on any allowlist. The domain was registered only two days ago. Which network-based IOC is most indicative of malicious activity?

   • AThe workstation IP
   • BThe domain name
   • CThe time of day
   • DThe data volume
   Reveal Solution Discussion Select an answer first