3.5 Identify, Hunt, and Investigate Leads and Indicators of Compromise (IOCs) XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   During an investigation, an analyst finds a domain that is used by a known APT group. The domain is also used by a commodity malware family. The analyst needs to determine the severity of the threat. Which factor would most increase the severity?

   • AThe domain is also used by the commodity malware family
   • BThe domain is used by the APT group in recent campaigns targeting the company's industry
   • CThe domain has been registered for more than five years
   • DThe domain is hosted on a shared server
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What does it mean for an analyst to 'triage' a lead during an investigation?

   • ATo automatically close the lead without review
   • BTo delete all logs related to the lead
   • CTo forward the lead to law enforcement
   • DTo prioritize the lead based on its potential impact and urgency
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A security analyst is reviewing a list of potential IOCs from a threat intelligence feed. Which item is a network-based indicator of compromise?

   • AA file hash that matches a known malware sample
   • BAn IP address that is known to be part of a botnet
   • CA process that creates a scheduled task
   • DA registry key that is modified by malware
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a common type of indicator of compromise (IOC)?

   • AA company's marketing slogan
   • BA user's display name
   • CA domain name used for command-and-control communication
   • DA server's physical location
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team wants to proactively hunt for signs of a known ransomware family that uses a specific file name and a unique registry key. The team has access to endpoint detection and response (EDR) logs and firewall logs. Which search strategy would be most effective?

   • ASearch both EDR and firewall logs for any suspicious activity
   • BSearch firewall logs for connections to known ransomware C2 domains
   • CSearch EDR logs for the file name and registry key
   • DSearch DNS logs for queries to domains associated with the ransomware
   Reveal Solution Discussion Select an answer first