5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard · select all that apply

   A security team is evaluating their detection strategy. They currently rely on file hash IOCs and a list of known malicious IPs. Which of the following are limitations of this approach? (Select all that apply.)

   • APolymorphic malware can change its hash to evade detection
   • BIOCs are reactive and may not detect zero-day threats
   • CIOCs can be used to detect all types of malware
   • DIOCs are always accurate and up-to-date
   • EIP addresses can be reused by legitimate services
   Check answers Discussion Select an answer first
2. 32foundation · easy

   How do security tools like EDR and SIEM use IOCs?

   • AThey use IOCs to manage user access permissions
   • BThey use IOCs to encrypt data at rest
   • CThey compare observed data against IOC lists to generate alerts
   • DThey use IOCs to patch vulnerabilities automatically
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following best describes a behavioral IOC?

   • AA domain name that is newly registered
   • BAn unusual pattern of data being transferred out of the network
   • CA service that is set to start automatically
   • DA file name that is commonly used by malware
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a limitation of relying solely on IOCs for threat detection?

   • AIOCs require too much storage space
   • BIOCs are only available for network-based threats
   • CIOCs are too slow to generate alerts
   • DIOCs only detect known threats and may miss novel or zero-day attacks
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a network-based indicator of compromise (IOC)?

   • AA registry key that disables security software
   • BA file hash of a known trojan
   • CA scheduled task that downloads malware
   • DA URL that is associated with a malware distribution site
   Reveal Solution Discussion Select an answer first