200-201 Question 197
Select 2A security analyst is reviewing system logs and notices unusual DNS requests, unexpected outbound traffic to an unknown IP address, and the presence of a new registry key on a user's workstation. Which combination of these observations could be considered indicators of compromise (IoCs)?
- A
Unusual DNS requests
- B
Unexpected outbound traffic to an unknown IP address
- C
A new registry key without additional context
- D
Scheduled system maintenance records
- E
High CPU usage during routine tasks
Show answer and explanation
Correct answers: A, B
Explanation
Indicators of compromise (IoCs) are specific artifacts or behaviors that suggest a security breach or malicious activity. Unusual DNS requests and unexpected outbound traffic to unknown IP addresses are clear signs of potential compromise. While other options may warrant investigation, they are not definitive IoCs without additional supporting evidence.
- A. Correct.
Unusual DNS requests are commonly associated with malware or command-and-control (C2) communications, making them a valid indicator of compromise.
- B. Correct.
Unexpected outbound traffic to an unknown IP address can signify data exfiltration or malicious communication with external servers, which is a strong indicator of compromise.
- C. Incorrect.
A new registry key alone is not necessarily an IoC without additional information, as new keys can be created during legitimate software installations or updates.
- D. Incorrect.
Scheduled system maintenance records are not IoCs as they are part of routine, legitimate operations.
- E. Incorrect.
High CPU usage during routine tasks could indicate performance issues or resource-intensive software but is not a definitive IoC without further evidence.