A SOC analyst is investigating an alert about a workstation communicating with a known malicious IP. The communication is encrypted and occurs during business hours. The analyst also notices the workstation is sending a large amount of data to this IP. Which combination of indicators provides the strongest evidence of compromise?

Network-based IOC (encrypted traffic) and host-based IOC (registry key)

Behavioral IOC (business hours) and file-based IOC (file name)

Host-based IOC (process) and file-based IOC (hash)

Network-based IOC (malicious IP) and behavioral IOC (data exfiltration)

Palo Alto NetworksCertified Cybersecurity Practitioner

Domain 5Objective 1

5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 8)

Part of the Endpoint Security domain, which accounts for 15% of the CYBERSECURITY-PRACTITIONER exam.

36questions here

8free pages

9concepts

15%of the exam

Questions 36–36

36expert · hard
A SOC analyst is investigating an alert about a workstation communicating with a known malicious IP. The communication is encrypted and occurs during business hours. The analyst also notices the workstation is sending a large amount of data to this IP. Which combination of indicators provides the strongest evidence of compromise?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CYBERSECURITY-PRACTITIONER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CYBERSECURITY-PRACTITIONER” is a trademark of its owner, used for identification only.

5.1 Identify and Explain Indicators of Compromise (IOCs) CYBERSECURITY-PRACTITIONER Practice Questions (Page 8)

Questions 36–36

Keep studying — Endpoint Security