350-201 Question 213
Select 3A security operations team has detected unusual outbound traffic from a critical server. Upon further investigation, they notice unknown files being uploaded to a suspicious external IP address. Which Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) should the team prioritize to determine if the server has been compromised?
- A
Frequent connections to a known malicious IP address
- B
Unusual login attempts from multiple geographic locations
- C
Presence of unauthorized applications or tools on the server
- D
Multiple failed access attempts followed by a successful login
- E
Scheduled tasks or scripts executing at odd hours
Show answer and explanation
Correct answers: A, C, E
Explanation
In this scenario, the Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) most relevant to the unusual outbound traffic and data exfiltration include frequent connections to a known malicious IP, unauthorized applications or tools deployed on the server, and suspicious scheduled tasks. These IOCs/IOAs point to potential compromise and data theft, aligning with the observed behavior.
- A. Correct.
Frequent connections to a known malicious IP address are a clear IOC, as they indicate potential malicious communication between the server and an attacker.
- B. Incorrect.
Unusual login attempts from multiple geographic locations are more indicative of a brute force or credential abuse attack, which is unrelated to the observed behavior in the scenario.
- C. Correct.
The presence of unauthorized applications or tools on the server is a strong IOC, as this often indicates an attacker has deployed tools for data exfiltration or persistence.
- D. Incorrect.
Multiple failed access attempts followed by a successful login suggest brute force or credential stuffing activity, which is not directly relevant to the described data exfiltration scenario.
- E. Correct.
Scheduled tasks or scripts executing at odd hours are an IOC, as they could indicate an attacker is automating actions such as data exfiltration or maintaining persistence.