Indicators of Malicious Activity (CySA+) Quiz

Submit

2. Which of the following best represents a complete IOC for threat intelligence sharing?

File hash, file path, malware family, and first-seen date

Just the MD5 hash of a suspicious file

Only the IP address of an attacker

Vague description of unusual network activity

Submit

4. Which scenario best demonstrates a host-based IOC rather than a network-based IOC?

Detection of a rootkit driver in system32 directory with abnormal code signature

Identification of traffic to a known C2 server on port 443

Recognition of DNS queries for a malicious domain

Observation of SYN flood packets from external sources

5. True or False: An IOC must be confirmed malicious across multiple independent sources before being actionable in an incident response.

True

False

6. Which log source is MOST critical for identifying indicators of malicious activity on a Windows endpoint?

Windows Event Log (Security, System, and Application logs)

Internet Explorer browsing history

Microsoft Word recent documents

Desktop shortcuts and file associations

Submit

8. Which of these are recognized IOC categories for CySA+ analysts? (Select all that apply)

File hashes and malware signatures

IP addresses and domains associated with threats

Email subject lines containing promotional content

Suspicious registry entries and file system artifacts

Submit

9. True or False: Indicators of Malicious Activity (CySA+) can only be detected through manual log review and cannot be automated.

True

False

10. Which indicator is most directly associated with lateral movement within a compromised network?

SMB traffic to multiple internal systems with failed access attempts

Increased DNS lookups for external domains

High CPU usage on the firewall

Increased email traffic to external recipients

11. Which of the following is a network-based indicator of compromise (IOC)?

Unusual outbound DNS queries to known malicious domains

Increased CPU usage during idle hours

Modified file permissions on user documents

Failed login attempts from internal users

12. In the context of IOCs, what does YARA rule detection primarily identify?

Malware signatures and patterns in files or memory

Network bandwidth utilization thresholds

User account lockout events

Certificate expiration dates

13. Which of the following are valid indicators of malicious activity? (Select all that apply)

Unexpected scheduled tasks with encoded commands

Large data transfers to external IP addresses at unusual times

Routine system backups to approved cloud storage

Privilege escalation attempts by non-admin accounts

Submit

14. True or False: Indicators of Malicious Activity (CySA+) include only network-based evidence and do not encompass host-based artifacts.

True

False

15. Which of these network artifacts would NOT typically be considered an IOC for malicious activity?

HTTPS traffic to legitimate cloud storage services

DNS queries to a known C2 server

Unusual port scanning activity

Connections to known botnet command-and-control addresses

Submit

17. Abnormal user login patterns, such as logins from geographically impossible locations, represent which type of IOC?

Behavioral IOC

File-based IOC

Network-based IOC

Cryptographic IOC

18. Which registry modification is a common IOC for malware persistence on Windows systems?

HKLM\Software\Microsoft\Windows\Run containing unknown executables

HKLM\System\CurrentControlSet\Services listing all installed drivers

HKEY_CURRENT_USER\Software\Microsoft\Office\Recent Files

HKLM\Software\Policies\Microsoft\Windows\Updates

19. True or False: A spike in network traffic to a single external IP address during off-hours is always a definitive indicator of a data exfiltration attack.

True

False

Submit

CySA+ IOC Quiz: Can You Read the Signs?

1. A sudden increase in failed authentication attempts followed by successful logins from a new device is a ____ IOC.

2.

What first name or nickname would you like us to use?

2. Which of the following best represents a complete IOC for threat intelligence sharing?

3. Data exfiltration to cloud storage services is typically detected by monitoring for ____ indicators such as unusual transfer volume and destination IP.

4. Which scenario best demonstrates a host-based IOC rather than a network-based IOC?

5. True or False: An IOC must be confirmed malicious across multiple independent sources before being actionable in an incident response.

6. Which log source is MOST critical for identifying indicators of malicious activity on a Windows endpoint?

7. A process injecting code into legitimate system processes is called ____ and is a strong IOC for malware.

8. Which of these are recognized IOC categories for CySA+ analysts? (Select all that apply)

9. True or False: Indicators of Malicious Activity (CySA+) can only be detected through manual log review and cannot be automated.

10. Which indicator is most directly associated with lateral movement within a compromised network?

11. Which of the following is a network-based indicator of compromise (IOC)?

12. In the context of IOCs, what does YARA rule detection primarily identify?

13. Which of the following are valid indicators of malicious activity? (Select all that apply)

14. True or False: Indicators of Malicious Activity (CySA+) include only network-based evidence and do not encompass host-based artifacts.

15. Which of these network artifacts would NOT typically be considered an IOC for malicious activity?

16. A process spawning child processes with suspicious command-line arguments is an example of a ____ IOC.

17. Abnormal user login patterns, such as logins from geographically impossible locations, represent which type of IOC?

18. Which registry modification is a common IOC for malware persistence on Windows systems?

19. True or False: A spike in network traffic to a single external IP address during off-hours is always a definitive indicator of a data exfiltration attack.

20. A file hash (MD5, SHA-256) is most useful for detecting malicious activity because it ____ uniquely identifies a specific file.