CS0-003 Incident Response and Management Practice Question
A security analyst is performing dynamic malware analysis using a sandbox. The analyst observes that the malware creates a scheduled task that executes a PowerShell command to download a payload from a remote server. Which of the following behavioral IOCs should be prioritized for detection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The creation of a scheduled task
The scheduled task creation is a persistent mechanism that can be detected via monitoring for new scheduled tasks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The domain name of the remote server
Why it's wrong here
While a domain name observed during dynamic analysis can be an immediate indicator, it is often a weak long-term Indicator of Compromise (IOC). Malware frequently utilizes Domain Generation Algorithms (DGAs) or legitimate compromised domains that are quickly taken down or rotated. This ephemeral nature means detection rules based solely on specific domain names quickly become outdated and ineffective against evolving threats or new variants.
- ✗
The hash of the initial malware sample
Why it's wrong here
The hash of an initial malware sample is a static indicator that is easily defeated by polymorphic or metamorphic malware. Even minor changes to the file, such as recompilation or packing, will result in a completely different hash. Consequently, relying on a specific file hash for detection is unreliable for identifying new variants or for long-term threat intelligence, as it lacks behavioral context.
- ✗
The IP address of the remote server
Why it's wrong here
An IP address observed during dynamic analysis is generally a volatile indicator of compromise. Command and Control (C2) servers frequently rotate IP addresses, utilize fast-flux networks, or leverage cloud services that dynamically assign IPs. This makes IP-based detection rules prone to rapid obsolescence and high false positives, as the same IP might be reassigned to legitimate services or the C2 infrastructure shifts.
- ✓
The creation of a scheduled task
Why this is correct
The creation of a scheduled task is a strong behavioral Indicator of Compromise (IOC) because it represents a common and critical persistence mechanism for malware. This action leaves distinct and observable artifacts within the operating system, such as registry entries or file system changes, which are consistent across different malware variants and environments. Detecting this behavior provides a robust and enduring method for identifying compromise.
Go deeper
Related to this question
Learn chapter
SIEM Log Analysis
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Malware analysis
Malware analysis is the process of examining malicious software to understand its behavior, origin, and impact, enabling defenders to detect, contain, and prevent future attacks.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.