3.5 Identify, Hunt, and Investigate Leads and Indicators of Compromise (IOCs) XDR-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A security analyst is reviewing a set of alerts and needs to identify which are indicators of compromise (IOCs). Which item should be classified as an IOC?

   • AA network switch's firmware version
   • BA system's uptime of 30 days
   • CA file hash that matches a known malware sample
   • DA user's browser history showing visits to a news website
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is documenting an investigation where a suspicious IP was found to be a false positive. The analyst wants to ensure the documentation is useful for future reference. Which element should be included?

   • AThe analyst's name
   • BThe date of the investigation
   • CThe IP address itself
   • DThe reasoning for why the IP was determined to be a false positive
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During an investigation, an analyst finds an IP address that is part of a known botnet infrastructure. The analyst wants to determine if this IP is related to a specific threat actor group. Which action would be most useful?

   • ALook up the IP's geolocation
   • BPerform a reverse DNS lookup on the IP
   • CCross-reference the IP with threat intelligence reports that attribute infrastructure to specific groups
   • DCheck if the IP is on any public blocklists
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is it important to document the reasoning behind each conclusion in an IOC investigation?

   • ATo replace the need for further monitoring
   • BTo increase the length of the investigation report
   • CTo provide a clear audit trail that supports the investigation's findings
   • DTo satisfy the requirements of a marketing campaign
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst at a mid-sized company notices a spike in outbound DNS queries to a domain that was recently registered and is not on any blocklist. The analyst wants to determine if this is a true indicator of compromise (IOC) before escalating. Which combination of evidence would most strongly support classifying the domain as an IOC?

   • AThe domain resolves to an IP address that is also contacted by multiple infected hosts in the environment
   • BThe domain has a low reputation score on a single threat intelligence feed
   • CThe domain is accessed by one workstation during normal business hours
   • DThe domain was registered with privacy protection and uses a free DNS service
   Reveal Solution Discussion Select an answer first