300-215 Question 76
Select 4While analyzing a SIEM alert, you notice unusual outbound traffic from a specific host to an unfamiliar IP address. You decide to investigate further using malware analysis tools and forensic techniques. Which Indicators of Compromise (IOCs) would confirm the host is compromised?
- A
Presence of a known malicious hash in the host's file system
- B
Unusual login attempts from a foreign IP in the authentication logs
- C
Frequent failed DNS resolutions to known malicious domains
- D
Consistent high CPU usage caused by a legitimate system process
- E
A process running on the host communicating with a blacklisted IP address
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Indicators of Compromise (IOCs) help identify if a host has been compromised during forensic analysis. Malicious file hashes, unusual authentication logs, failed DNS resolutions to malicious domains, and communication with blacklisted IPs are all strong indicators. Identifying these through SIEM and malware analysis tools can confirm the compromise. High CPU usage, on the other hand, is not inherently suspicious without additional context.
- A. Correct.
Malware analysis tools can identify malicious file hashes, which are strong Indicators of Compromise (IOCs). This is a valid IOC for confirming compromise.
- B. Correct.
Unusual login attempts from foreign IPs can indicate unauthorized access attempts or brute force attacks. This is a valid IOC.
- C. Correct.
Failed DNS resolutions to known malicious domains suggest the host might be attempting to contact a Command and Control (C2) server. This is a valid IOC.
- D. Incorrect.
Consistent high CPU usage could be caused by legitimate processes, and without further evidence, it is not a definitive IOC.
- E. Correct.
A process communicating with a blacklisted IP address strongly indicates malicious behavior and is a valid IOC.