ExamworthyExamworthy
Open the appStart free

SY0-701 - Threats, Vulnerabilities, and Mitigations - Section 2.4

Given a scenario, analyze indicators of malicious activity.

Recognise indicators of compromise associated with malware, network attacks, application attacks, and cryptographic attacks by correlating observable artefacts such as unusual traffic patterns, unexpected processes, or anomalous authentication events. Apply this analysis to classify an ongoing attack and determine which further investigation steps are appropriate.

malware attacksnetwork attacksapplication attackscryptographic attacksindicators of compromise

Practice question for this objective

Free sampleThreats, Vulnerabilities, and Mitigationshard

A SOC analyst is triaging telemetry from a single finance workstation after an endpoint alert. Reviewing a mix of host and network events from the same shift, the analyst must separate genuine indicators of compromise from ordinary background activity before declaring an incident. Which TWO of the following observations are the strongest indicators of malicious activity on this host? Select TWO.

  • AAn outbound TLS session is opened to the same external host every 60 seconds, each carrying a near-identical small payload with very low variance in timing and size. Correct
  • BA signed updater service contacts the vendor's content delivery network over HTTPS at the scheduled daily check-in time and downloads a digitally signed package.
  • CA spawned PowerShell process with an encoded command line writes no file to disk and immediately opens a connection to a domain registered three days earlier. Correct
  • DThe workstation synchronises its clock with two internal NTP servers on UDP 123 and drifts back into alignment within a few milliseconds of the reference time.
  • EA user opens several internal SharePoint pages over the corporate proxy during business hours, each request authenticated with the user's own Kerberos ticket.
Distinguish genuine indicators of compromise, such as low-jitter beaconing and fileless living-off-the-land execution, from benign background activity on an endpoint. Beaconing shows up as regular, low-variance callbacks to one external host, and fileless execution via an encoded interpreter command reaching a newly registered domain are recognised indicators of command-and-control. Signed scheduled updates, internal NTP synchronisation, and authenticated internal browsing are expected background activity that mimics suspicious traffic without being malicious.

Why A is correct: Highly regular, low-jitter connections of fixed small size to one external host are classic beaconing, a strong indicator of command-and-control callback rather than human-driven traffic.

Why B is wrong: This looks suspicious because it is outbound HTTPS to an external endpoint, but a signed updater hitting its vendor CDN on schedule with a signed payload is expected maintenance, not an indicator of compromise.

Why C is correct: Fileless execution through an encoded living-off-the-land script that reaches a freshly registered domain combines several recognised indicators of malicious activity into one high-confidence signal.

Why D is wrong: Periodic UDP traffic can resemble beaconing at a glance, but routine NTP synchronisation against sanctioned internal time sources is benign infrastructure activity, not an indicator of compromise.

Why E is wrong: Authenticated browsing of internal resources through the sanctioned proxy during working hours is normal user behaviour, so it is tempting only as filler and carries no signal of malicious activity.

See more SY0-701 practice questions, answers explained.

More in this domain

Back to all Threats, Vulnerabilities, and Mitigations objectives, or the SY0-701 cert hub.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.