Security Monitoring →easyMultiple SelectObjective-mapped

200-201 Security Monitoring Practice Question

Which TWO of the following are examples of Indicators of Compromise (IoCs) used in network security monitoring? (Choose two.)

⚠ Common exam trap

Cisco often tests the distinction between IoCs (specific, actionable artifacts of compromise) and unrelated contextual data (like time, stock price, or employee count) to see if candidates understand that IoCs must directly indicate malicious activity, not just general system or business information.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

MD5 hash of a malicious executable

An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a network or system. The MD5 hash of a malicious executable is a file-based IoC that allows security monitoring tools to detect known malware by comparing file hashes against threat intelligence feeds. This is a standard IoC used in signature-based detection systems like Snort or YARA.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
MD5 hash of a malicious executable
Why this is correct
File hashes are used to identify known malware samples.
✓
IP addresses of known command and control servers
Why this is correct
C2 IPs are classic IoCs used to detect compromised hosts communicating outbound.
✗
The current time of day
Why it's wrong here
Time of day is not an IoC.
✗
The company's stock price
Why it's wrong here
Stock price is unrelated to technical security monitoring.
✗
The number of employees in the company
Why it's wrong here
This is organizational data, not a technical indicator of compromise.

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question