200-201 Security Monitoring Practice Question
A SOC analyst is investigating a potential data exfiltration incident. Which TWO Indicators of Compromise (IoCs) would be most relevant for tracking the exfiltration of files over the network?
⚠ Common exam trap
Cisco often tests the distinction between host-based IoCs (mutexes, registry keys) and network-based IoCs (URLs, IPs, file hashes) in data exfiltration scenarios, leading candidates to mistakenly select mutex or registry options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
URLs
URLs are correct because they can indicate the destination of exfiltrated data, such as a cloud storage endpoint or a command-and-control server. File hashes (MD5/SHA-256) are correct because they uniquely identify the specific files being transferred, allowing the analyst to track known malicious or sensitive files across the network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
URLs
Why this is correct
URLs can show where data was sent.
- ✗
IP addresses
Why it's wrong here
IP addresses can be dynamic and less specific to files.
- ✗
Mutex names
Why it's wrong here
Mutex names are indicators of malware presence, not exfiltration.
- ✗
Registry keys
Why it's wrong here
Registry keys are more relevant for persistence on a host.
- ✓
File hashes (MD5/SHA-256)
Why this is correct
File hashes uniquely identify files exfiltrated.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.