350-201 Question 215
Select 3Your organization has detected unusual outbound traffic from a server that typically handles internal application data. Upon further investigation, you find connections to an unknown IP address and the presence of a suspicious executable file. Which of the following are valid Indicators of Compromise (IOCs) or Indicators of Attack (IOAs) in this scenario?
- A
Outbound traffic to an unfamiliar IP address
- B
Presence of a suspicious executable file on the server
- C
High CPU usage during normal business hours
- D
The server is running a scheduled backup job
- E
Repeated failed login attempts from an external IP
Show answer and explanation
Correct answers: A, B, E
Explanation
Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) are artifacts or behaviors that suggest malicious activity. In this scenario, outbound traffic to an unfamiliar IP, a suspicious executable file, and repeated failed login attempts all point to potential security incidents. High CPU usage and a scheduled backup job, on the other hand, are not inherently indicative of compromise unless there is additional supporting evidence.
- A. Correct.
Outbound traffic to an unfamiliar IP address can indicate potential data exfiltration or unauthorized access, making it a valid IOC/IOA.
- B. Correct.
The presence of a suspicious executable file on the server could indicate malicious software or unauthorized activity, making it a valid IOC/IOA.
- C. Incorrect.
High CPU usage during normal business hours is not necessarily an IOC/IOA unless associated with abnormal patterns or malicious activity.
- D. Incorrect.
A scheduled backup job is a normal operation and does not constitute an IOC/IOA unless it deviates from expected behavior.
- E. Correct.
Repeated failed login attempts from an external IP are indicative of a potential brute force attack, making it a valid IOC/IOA.