01
Choose one
1 point
A host makes repeated, regular outbound connections to an unfamiliar destination. Which interpretation best fits this observation?
Free Practice Quiz Question List
5 Indicators of Compromise Online Quiz Questions
Use this free practice quiz with 20 questions to review 5 Indicators of Compromise, test your knowledge, and prepare for your next test or exam.
20 questions
02
True or false
1 point
True or false: A match to an indicator of compromise automatically proves that a system was compromised and identifies who caused it.
- A
True
- B
False
03
Written response
1 point
What reference is used to judge whether activity is unusual for a user or system?
04
Fill in the blank
1 point
Host-based indicators come from or their logs.
05
Choose one
1 point
An account runs discovery commands and then moves laterally to another system. Which kind of indicator best describes this sequence?
- A
A host-based indicator, because it must identify a suspicious file
- B
A network-based indicator, because it must identify a remote IP address
- C
A behavior-based indicator, because it describes a sequence of actions
06
Choose all
1 point
Which actions help validate a reported IOC match? Select all that apply.
- A
Record the exact observation and relevant source, asset, account, and event time
- B
Treat a reputation label as proof that the local match is malicious
- C
Verify that the value matches and that the event occurred on the reported asset and within the relevant time period
- D
Correlate related host, network, identity, or application events
07
Written response
1 point
What concise term describes recurring, regular outbound connections that may indicate command-and-control activity?
08
Fill in the blank
1 point
An IOC match may connect an event to a known campaign or tool, but it does not by itself prove .
09
True or false
1 point
True or false: If searches for known indicators return no matches, compromise can be ruled out.
- A
True
- B
False
10
Choose one
1 point
A threat report lists a file hash as an IOC. Which check most directly confirms that the reported match applies to a local event?
- A
Assume the match is malicious if the indicator has a reputation label
- B
Verify the exact value, reported asset, and relevant time period
- C
Search only for the same value on unrelated assets
- D
Treat missing event data as proof that no match occurred
11
Choose all
1 point
An unusual privilege change is detected on a server. Which checks can help test benign explanations? Select all that apply.
- A
Compare the event with known maintenance
- B
Check whether approved software could explain the activity
- C
Assume an unusual action is malicious without checking context
- D
Compare the activity with scheduled jobs, security scans, and normal activity for the user or system
12
Choose one
1 point
Why should an analyst consider when an IOC was observed and whether it may be stale?
- A
A match always identifies the same actor, even when infrastructure is shared
- B
A non-match proves that the system is safe
- C
An old match may no longer describe current malicious activity because indicators can change or be reused
- D
A unique file hash detects every changed version of that file
13
Open ended
1 point
An alert reports an unusual outbound connection from a workstation. Describe how an analyst should investigate it before deciding whether to escalate or contain.
14
True or false
1 point
An exact match to a published indicator of compromise proves that the local event was malicious. True or false?
- A
True
- B
False
15
Choose one
1 point
An investigator finds an unfamiliar scheduled task on a server. Which category best describes this indicator?
- A
Host-based indicator
- B
Network-based indicator
- C
Behavior-based indicator
16
Choose one
1 point
A host connects to an IP address associated with malicious activity, but the address belongs to a shared hosting service. What is the most appropriate next step?
- A
Treat every connection to a shared hosting address as malicious
- B
Ignore the match because shared infrastructure cannot be used maliciously
- C
Investigate the connection alongside its destination, process, user, and related events
- D
Conclude that the hosting provider operated the suspected attack
17
Written response
1 point
When deciding whether a user's activity is unusual, what reference should an analyst compare it against?
18
Choose one
1 point
A published indicator is a file hash, and an alert reports a possible match. Which action best confirms whether the indicator applies to the event?
- A
Assume that a reputation label is sufficient if the indicator is published
- B
Verify the exact value, asset, and time period, then examine relevant file context where available
- C
Confirm only that the indicator appears in a threat-intelligence source
- D
Treat any similar-looking value on any asset as a confirmed match
19
Written response
1 point
When documenting shared or published intelligence, what stated assessment should be recorded alongside its source and observation time?
20
Choose one
1 point
An unusual outbound connection is followed by unexpected credential activity and a persistence change. Which analysis would provide the strongest additional support for investigating a possible compromise?
- A
Classify the event based only on the reputation of its destination
- B
Search only for the same indicator value on the original system
- C
Correlate related host, network, identity, and application events for a plausible sequence
- D
Attribute the activity to the first campaign associated with the indicator