CS0-003 Incident Response and Management Practice Question
During dynamic analysis of a suspicious file in a sandbox environment, which THREE behaviors are considered indicators of compromise (IOCs) that suggest malicious activity? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Creating a registry run key to achieve persistence.
Dynamic analysis monitors behavior. Outbound connections to known bad IPs, creation of suspicious registry keys, and dropping files in startup folders are common malicious behaviors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Creating a registry run key to achieve persistence.
Why this is correct
A registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) is an autostart extension point that launches a specified executable at user logon. Malware frequently adds entries here to achieve persistence, ensuring the malicious code runs on every subsequent login. Sandbox analysis treats this as high-risk because legitimate programs rarely modify such keys during a single execution, especially with randomly named or masqueraded values.
- ✓
Outbound network connections to a known malicious IP.
Why this is correct
During dynamic analysis, the sandbox monitors all outbound traffic for indicators of compromise. A connection to a known malicious IP address strongly suggests command-and-control (C2) communication, data exfiltration, or retrieval of additional payloads. This is a critical behavioral signature, as even files that perform no file system writes may be conducting covert network activity that aligns with threat intelligence.
- ✗
The file reading its own content.
Why it's wrong here
An executable reading its own content is commonly seen in legitimate software for integrity checks, resource extraction, or digital signature verification. This action does not modify the system, create persistence, or communicate externally, so it is not inherently malicious. In a sandbox, it may be an anti-tampering technique, but without other suspicious behaviors, it is insufficient to classify the sample as malware.
- ✓
Dropping an executable file in the startup folder.
Why this is correct
The Windows Startup folder (e.g., shell:startup) is a user-level autostart location that runs any executable or shortcut at logon. Malware often drops a payload here to establish persistence without requiring elevated privileges or registry changes. Sandbox detonation flags this because it creates a persistent file system artifact that ensures malicious code executes on future login sessions, a classic persistence technique.
- ✗
Opening a text file that was already present.
Why it's wrong here
Opening a text file that already exists on the system is typical benign behavior, as many programs read configuration files, documentation, or data samples during normal operation. This action involves no writes to autostart locations, no modification of system settings, and no external communication. Without additional malicious context, such a file read is considered neutral and does not indicate compromise.
Go deeper
Related to this question
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.