200-201 Question 196
Select 3You are a cybersecurity analyst reviewing logs from an endpoint detection and response (EDR) system. You notice unusual activity on a user’s device, including repeated failed login attempts to multiple accounts, a large volume of outbound traffic to an unfamiliar IP address, and the presence of a new, unsigned executable running in the background. Which of the following are valid indicators of compromise (IoCs) in this scenario?
- A
Repeated failed login attempts to multiple accounts
- B
Large volume of outbound traffic to an unfamiliar IP address
- C
The presence of a new, unsigned executable running in the background
- D
Frequent access to legitimate services such as email or cloud storage
- E
Regular operating system updates being installed automatically
Show answer and explanation
Correct answers: A, B, C
Explanation
Indicators of compromise (IoCs) are artifacts or evidence on a network or system indicating potential malicious activity. In this scenario, repeated failed login attempts, unusual outbound traffic, and the presence of an unsigned executable all point to potential compromise and are valid IoCs. Legitimate activities such as accessing services or regular updates are not considered IoCs.
- A. Correct.
Repeated failed login attempts can indicate a brute force or credential stuffing attack, making this a valid IoC.
- B. Correct.
Unusual outbound traffic, especially to unfamiliar IP addresses, is a common sign of data exfiltration or compromised systems, making this a valid IoC.
- C. Correct.
The presence of a new, unsigned executable could indicate malware or unauthorized software, making this a valid IoC.
- D. Incorrect.
Frequent access to legitimate services is normal behavior for most users and is not an IoC in this context.
- E. Incorrect.
Regular operating system updates are expected and are a sign of a well-maintained system, not an IoC.