SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The current domain name because it is the easiest item to block immediately.

  Why it's wrong here

  The current domain name might be easy to block immediately via DNS sinkholing or allowlisting, but an adversary that rotates domains will likely retire this domain quickly or use a domain generation algorithm (DGA) to produce new ones, giving the indicator a very short usable lifetime. It only provides temporary containment, not a persistent detection point, and defensively it forces continuous manual updates as the attacker cycles through endpoints. Because the malware binary remains the same, the hash stays valid across all future domain changes, making it a much more durable IOC.

• ✓

  The malware's SHA-256 file hash because it uniquely identifies the sample.

  Why this is correct

  A file hash is a highly specific indicator for a known binary and remains useful even if the attacker changes domains or hosting providers. Since the report says the same malware sample is reused, the hash provides a stable detection and correlation point across campaigns. It is a stronger immediate IOC than infrastructure that can be replaced quickly.

• ✗

  The cloud provider's entire ASN because all traffic from that provider is automatically malicious.

  Why it's wrong here

  Blocking an entire cloud provider's ASN treats all traffic from that provider as malicious, but those address blocks contain thousands of legitimate services, including services the victim organization itself relies on. This would cause massive false positives and likely disrupt legitimate business operations, while a sophisticated adversary can simply rent infrastructure from another provider or route traffic through a CDN or proxy. An ASN has no inherent correlation with a specific malware sample, so it is both too broad and too transient to serve as a precise indicator of compromise.

• ✗

  The malware's file name because attackers usually keep the same name for convenience.

  Why it's wrong here

  A malware file name is just mutable metadata that the attacker controls and can trivially change before delivery; the same binary can be renamed to svchost.exe, a random string, or a name mimicking a trusted application. Modern endpoint detection engines do not reliably treat file names as trustworthy signals, and defenders frequently see false positives when legitimate software happens to share the same name. In contrast, a SHA-256 hash is derived from the exact byte content of the binary, making it a stable and immutable identifier, whereas the file name is merely a cosmetic label that can be altered without changing the sample.

Go deeper

Related to this question