5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Why is it important to update IOC lists regularly?

   • ABecause IOCs can become stale as attackers change their infrastructure and techniques
   • BBecause IOCs are only valid for 24 hours
   • CBecause IOCs are automatically generated by the operating system
   • DBecause IOCs are stored in a central database that requires daily maintenance
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst is building a detection rule for a new malware family. They have a sample and want to create an IOC that is both specific and resilient to minor variations. Which approach is best?

   • AUse the file size of the sample
   • BUse a file hash of the sample
   • CUse the file name of the sample
   • DUse a behavioral IOC based on the malware's network communication pattern
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An organization's EDR alerts on a process that is encrypting files and then attempting to connect to an external IP. The process is not a known application. Which combination of IOC types is most relevant?

   • AHost-based and file-based IOCs
   • BFile-based and behavioral IOCs
   • CBehavioral and network-based IOCs
   • DNetwork-based and host-based IOCs
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following best describes a network-based IOC?

   • AAn IP address known to be used for command-and-control communication
   • BA process that injects code into other processes
   • CA registry modification that adds a startup entry
   • DA file path where malware is installed
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following categories of IOCs includes registry keys and scheduled tasks?

   • AHost-based IOCs
   • BBehavioral IOCs
   • CNetwork-based IOCs
   • DFile-based IOCs
   Reveal Solution Discussion Select an answer first