easyMultiple Select
CS0-003 Practice Question: Which TWO of the following are common indicators…
Which TWO of the following are common indicators of compromise (IOCs) that can be identified through log analysis?
⚠ Common exam trap
CompTIA often tests the distinction between operational anomalies (like expired certificates) and true security indicators (like hash changes), expecting candidates to recognize that only events directly tied to unauthorized access or malicious modification qualify as IOCs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unexpected changes to file hashes
Unexpected changes to file hashes (A) are a key indicator of compromise because they suggest that a file has been modified, potentially by malware or an attacker. Log analysis can detect these changes by comparing current file hashes against a known-good baseline, revealing unauthorized alterations that may indicate a security breach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Unexpected changes to file hashes
Why this is correct
File integrity monitoring (FIM) tools track cryptographic hashes, such as SHA-256, of critical system files. An unexpected change in these hashes indicates that a file has been modified, potentially replaced by malware or tampered with by an attacker to establish persistence or escalate privileges.
- ✗
Expired SSL certificates
Why it's wrong here
While expired SSL/TLS certificates disrupt secure communications and trigger browser warnings, they typically stem from administrative oversight or poor certificate lifecycle management. They represent a service availability or configuration issue rather than an active indicator of compromise pointing to an ongoing intrusion.
- ✗
Scheduled backup completion logs
Why it's wrong here
Successful completion logs for scheduled backups represent routine, authorized administrative operations. These logs confirm that data preservation policies are functioning correctly and do not indicate unauthorized access, system tampering, or any form of malicious adversary behavior.
- ✗
Use of strong passwords
Why it's wrong here
Implementing and enforcing strong, complex passwords is a proactive preventative security control designed to mitigate brute-force and credential-stuffing attacks. This practice represents a defensive posture and a hygiene measure rather than an indicator that a system has already been breached.
- ✓
Unusual outbound network connections
Why this is correct
Outbound traffic directed to unfamiliar external IP addresses, especially over non-standard ports or during off-hours, is a classic indicator of compromise. This behavior often points to command-and-control (C2) communications, beaconing activity, or active data exfiltration by an adversary.
Go deeper
Related to this question
Learn chapter
OWASP Top 10 for Security Analysts
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.