A threat report says an attacker changes domains daily and rehosts infrastructure in cloud VPS environments, but the phishing email wording, login-page flow, and PowerShell download behavior remain the same. What type of information is most useful for a durable detection rule?

Only the current malware hash from the latest sample

Hashes change quickly and are useful for identification, but they are not durable against frequent attacker updates.

The names of the victim company’s departments

Victim-specific business terms do not help create a generalizable detection for the campaign.

A screenshot of the phishing email subject line only

Subject lines are easy to change and usually become stale quickly after the attacker modifies the lure.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: The attacker’s behavioral pattern and technique sequence — The attacker’s behavioral pattern and technique sequence are the most useful for a durable detection rule. Infrastructure indicators such as domains, IP addresses, and hashes change frequently, especially when an adversary uses rotating cloud hosting. In contrast, consistent behaviors like a predictable login flow or PowerShell download cradle are harder to change and provide stronger long-term detection value. Why others are wrong: A hash is useful for one sample but becomes stale quickly when the adversary rebuilds or rehosts tools. Victim department names are irrelevant to broader detection. A subject line screenshot is a weak indicator because attackers can alter wording with minimal effort and evade simple matching.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.