300-215 Question 79
Select 3While investigating a potential compromise on a host, you use a SIEM to analyze logs and identify Indicators of Compromise (IOCs). The SIEM displays the following outputs: repeated failed login attempts from an external IP, an unusual process initiating outbound traffic to an unknown domain, and a file downloaded from a suspicious URL. Which of the following IOCs should you prioritize for further investigation?
- A
Repeated failed login attempts from an external IP
- B
Unusual process initiating outbound traffic to an unknown domain
- C
A file downloaded from a suspicious URL
- D
An internal user logging into the SIEM at an odd hour
Show answer and explanation
Correct answers: A, B, C
Explanation
Identifying and prioritizing IOCs in SIEM outputs is critical for effective incident response. In this scenario, the repeated failed login attempts, unusual outbound traffic, and suspicious file download are all strong indicators of possible malicious activity that require further investigation. While odd-hour SIEM logins can be noteworthy, they do not necessarily indicate malicious activity without additional context.
- A. Correct.
Repeated failed login attempts from an external IP can indicate brute force attacks or unauthorized access attempts, which are critical IOCs.
- B. Correct.
An unusual process initiating outbound traffic to an unknown domain may suggest malware activity or data exfiltration, making it a significant IOC.
- C. Correct.
A file downloaded from a suspicious URL is a potential IOC as it could indicate the delivery of malware or phishing activity.
- D. Incorrect.
An internal user logging into the SIEM at an odd hour could be suspicious, but it is a weaker IOC compared to the others, as it might just indicate legitimate activity outside of normal working hours.