3.5 Identify, Hunt, and Investigate Leads and Indicators of Compromise (IOCs) XDR-ANALYST Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   What is the primary purpose of proactive hunting for indicators of compromise (IOCs)?

   • ATo document all network traffic for compliance
   • BTo generate more alerts for the SOC to review
   • CTo identify potential threats before they trigger automated alerts
   • DTo replace the need for automated alerting entirely
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which data source would be most useful when hunting for indicators of compromise (IOCs) related to network communication?

   • AEmployee HR records
   • BFirewall traffic logs
   • CBuilding access logs
   • DMarketing campaign analytics
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   During a hunt, an analyst finds a file hash that is associated with a known ransomware family. The hash is also present in a public sandbox report that shows the ransomware encrypting files. The analyst wants to determine if the company is at risk. Which additional information would be most useful?

   • AThe ransomware's encryption algorithm
   • BThe date the sandbox report was published
   • CWhether any systems in the environment have the file hash
   • DThe ransomware family's typical ransom amount
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is reviewing a list of potential IOCs from a threat intelligence feed. Which item is a behavioral indicator of compromise?

   • AA process that creates a scheduled task to run a script at startup
   • BA domain that is similar to a legitimate company's domain
   • CA file hash that matches a known malware sample
   • DAn IP address that is known to be part of a botnet
   Reveal Solution Discussion Select an answer first