300-215 Question 157
Select 3You are a security analyst investigating a potential breach in your organization's network. While reviewing internal threat intelligence feeds from Cisco SecureX and external feeds from a third-party provider, you identify a series of suspicious IP addresses, file hashes, and domain names. Which of the following accurately represent Indicators of Compromise (IOCs) or Indicators of Attack (IOAs) that you should prioritize for further investigation?
- A
A domain name associated with known phishing campaigns reported by the external feed
- B
A file hash matching a known malware sample identified in your internal feed
- C
A legitimate IP address used by an organization's content delivery network (CDN)
- D
An unusual DNS query pattern indicating potential data exfiltration attempts
- E
A benign email header analyzed and flagged as safe by the organization's email security solution
Show answer and explanation
Correct answers: A, B, D
Explanation
Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) are critical for identifying malicious activity in a network. IOCs are artifacts such as file hashes, IP addresses, or domain names tied to known malicious behavior, while IOAs indicate the tactics or actions of an attacker, such as unusual DNS query patterns. In this scenario, the suspicious domain, malicious file hash, and DNS query pattern should be prioritized for investigation, as they represent significant indicators of potential compromise or attack.
- A. Correct.
A domain name associated with known phishing campaigns is a valid IOC as it is tied to malicious activity and provides evidence of an attack vector.
- B. Correct.
A file hash matching a known malware sample is a strong IOC since it directly correlates to a malicious file that has been identified as part of the breach.
- C. Incorrect.
A legitimate IP address used by a CDN is not an IOC or IOA, as it is a benign and expected part of normal network operations.
- D. Correct.
An unusual DNS query pattern could indicate an IOA, as it may signify data exfiltration behavior, which is a tactic attackers use to achieve their objectives.
- E. Incorrect.
A benign email header flagged as safe is not an IOC or IOA, as it does not exhibit any indicators of malicious activity or attack.