350-201 Question 214
Select 4Your organization recently experienced a security breach where an attacker exfiltrated sensitive data. As a cybersecurity analyst, you are tasked with identifying Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) to prevent future attacks. Which of the following are examples of IOAs or IOCs that you might detect during your investigation?
- A
Unusual outbound traffic from a server at odd hours
- B
A known malicious hash detected in a file during a scan
- C
Repeated failed login attempts from a single IP address
- D
A legitimate software update downloaded from a trusted source
- E
Unrecognized registry changes on critical systems
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Indicators of Compromise (IOCs) are evidence of a successful breach, such as malicious file hashes or registry changes, while Indicators of Attack (IOAs) are evidence of an ongoing or attempted attack, such as suspicious login attempts or unusual network traffic. By analyzing these indicators, cybersecurity professionals can detect, investigate, and respond to threats effectively.
- A. Correct.
Unusual outbound traffic, especially at odd hours, is a strong Indicator of Compromise (IOC) as it may suggest data exfiltration or command-and-control communication.
- B. Correct.
A known malicious hash is a classic IOC, as it directly correlates to a previously identified piece of malware.
- C. Correct.
Repeated failed login attempts from a single IP address are an Indicator of Attack (IOA) because they suggest an active brute-force or credential-stuffing attempt.
- D. Incorrect.
A legitimate software update from a trusted source is not an IOC or IOA, as it is a normal and secure operational behavior.
- E. Correct.
Unrecognized registry changes may indicate malicious activity or persistence mechanisms, making it a valid IOC.