Security+ Indicators of Compromise Recognition

1. Which of the following indicates a potential DNS poisoning or hijacking attack?

DNS queries resolving to expected IP addresses

DNS queries resolving to unexpected IP addresses for known domains

Regular recursive DNS queries

Standard DHCP lease renewal

2. What does the presence of suspicious PowerShell commands in Windows event logs indicate?

Normal system administration

Legitimate script execution

Potential post-exploitation activity or privilege escalation attempt

Standard Windows update process

3. An unexpected privileged account being used for interactive login at unusual times is an IoC for what?

Normal administrator activity

Legitimate scheduled maintenance

Potential credential theft or privilege escalation attack

Standard service account operation

4. Which of the following represents a strong IoC for ransomware infection?

Normal file access patterns

Bulk file encryption activity and ransom note creation

Standard user document editing

Routine backup execution

5. Detecting a process with a legitimate name running from an unusual location is an IoC for which attack?

Network connectivity issue

Process masquerading or living-off-the-land attack

User installing new software

Standard system startup routine

6. What does a sudden spike in error messages or crash dumps typically indicate?

System running normally

Legitimate user troubleshooting

Potential exploit attempt or system compromise

Standard Windows startup process

7. The presence of obfuscated or encoded scripts in web server logs is an IoC for what?

Normal website functionality

Legitimate content delivery

Potential web application attack or exploitation attempt

Standard image file serving

8. Which indicator suggests possible data exfiltration is occurring?

Incoming HTTPS traffic from trusted sources

Outbound traffic to unknown servers in bulk quantities

Normal internal network communication

Standard web page downloads

9. Unexpected changes to system files detected by file integrity monitoring are an IoC for what?

Routine software patching

Potential malware or unauthorized system modification

User file storage

Temporary cache clearing

10. What does detecting multiple failed authentication attempts from different geographic locations simultaneously suggest?

Normal user behavior

Distributed brute force or credential stuffing attack

Standard mobile device access

Routine VPN connection

11. Which of the following is a primary indicator of compromise when detected on a user's workstation?

Unexpected scheduled tasks running at off-hours

Legitimate Windows Update service running

Antivirus software installed and updated

User login during business hours

12. An unexpected increase in CPU or memory usage by a non-critical process is an IoC for which threat?

Legitimate background update

Cryptocurrency mining malware

Normal user application launch

Standard antivirus scanning

13. What does the presence of suspicious scheduled tasks in Windows Task Scheduler typically indicate?

Normal system maintenance

Potential malware persistence mechanism

User-created backup jobs

Windows automatic updates

14. Which network traffic pattern suggests possible command-and-control (C2) communication?

Regular HTTP requests to CDN services

Periodic connections to unusual external IPs on non-standard ports

Continuous streaming video playback

Standard email SMTP traffic

15. Unusual process execution from temporary directories is an IoC for what threat?

Legitimate software installation

Potential malware execution

Standard Windows updates

User desktop shortcuts

16. What does a hash mismatch between a known-good file and its current version indicate?

The file was updated normally

The file may have been modified by malware or an attacker

The file is compressed

The file is encrypted

17. Which file system artifact would indicate malware persistence on a Windows system?

Executable files in System32 folder

Unexpected registry entries in Run or RunOnce keys

Standard Windows DLL files

User profile folders

18. A sudden increase in failed login attempts followed by one successful login is a sign of what type of attack?

Brute force attack

Man-in-the-middle attack

Denial of service attack

Packet sniffing

19. Which log source is most valuable for detecting lateral movement within a network?

Web server access logs

Windows Security Event logs and authentication events

Printer activity logs

Email calendar logs

20. What does an abnormal outbound network connection to an unknown IP address typically indicate?

Normal content delivery network activity

Potential data exfiltration or malware command-and-control communication

Routine DNS resolution

Standard web browsing traffic

Security+ Indicators of Compromise Recognition Quiz