CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  CPU registers

  Why it's wrong here

  CPU registers are ephemeral, processor-level storage that holds data for active computations; during incident response, the contents are lost the moment the process is terminated or the system is powered down. Unlike network or file artifacts, registers are not persistent and do not travel across systems, so they are not practical indicators for threat intelligence sharing or host-based detection. They may be useful for volatile memory forensics in-progress, but not as IOCs.

• ✓

  IP addresses

  Why this is correct

  IP addresses are fundamental network-level IOCs because they denote the source or destination of malicious traffic observed in logs, packet captures, or DNS queries. When an infection communicates with a command-and-control (C2) node or an attacker launches a brute-force attack, that IP address becomes a repeatable, searchable value in firewall logs, SIEM alerts, and threat feeds. Sharing an IP address allows other organizations to block the endpoint, but note that IPs can change quickly, making them a time-sensitive indicator.

• ✓

  Domain names

  Why this is correct

  Domain names are valuable IOCs because they often serve as persistent C2 infrastructure or phishing destinations, and they appear in DNS logs, proxy logs, and malware configuration strings. Unlike raw IPs, domains can be flagged for sinkholing, threat intelligence reputation scoring, and content filtering across many organizations. Domains provide a higher-level indicator that may outlive a single IP, though attackers often rotate domains to evade detection.

• ✗

  Software version numbers

  Why it's wrong here

  Software version numbers describe a product's release or build and are not malicious artifacts; they indicate patch level, not whether a system is compromised or has communicated with an attacker. While vulnerability scanners might flag outdated versions as susceptible to known CVEs, that is a risk assessment data point, not an indicator of a specific compromise event. Thus version numbers are context for vulnerability management, not shared as IOCs in an incident response playbook.

• ✓

  File hashes

  Why this is correct

  File hashes, such as SHA-256, are unique cryptographic fingerprints of a file's exact byte content, allowing analysts to definitively identify known malware samples across hosts without needing the sample itself. Because even a single-bit change alters the hash, matching a hash to a file on another system is strong evidence of the same malicious binary. They are a mainstay of IOC sharing, but only cover static files—not network behavior or in-memory activity.

Go deeper

Related to this question