SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Analysts see a malware campaign that changes its command-and-control domain every day, but the executable hash and a unique registry value remain the same across incidents. Which indicator is the best candidate for hunting?
⚠ Common exam trap
The trap here is that candidates focus on the changing domain (a dynamic indicator) because it is directly observable in network traffic, but the exam tests the understanding that static indicators (like the hash) are more persistent and effective for hunting across multiple incidents.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The executable hash from the malware sample.
The executable hash (e.g., SHA-256) and the unique registry value are static, immutable artifacts that persist across every incident, regardless of the daily domain rotation. These indicators are far more reliable for hunting since they directly identify the malware binary itself, whereas the domain changes frequently and may be blocked or sinkholed after detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The daily domain name used for command and control.
Why it's wrong here
The daily domain name is an unreliable indicator because this campaign uses domain generation algorithms (DGAs) or fast-flux DNS to rotate command-and-control domains constantly. By the time analysts extract and share the observed domain, the adversary has already switched to a new one, and the old domain may be sinkholed or repurposed, so it holds little long-term value for identifying other compromised hosts.
- ✓
The executable hash from the malware sample.
Why this is correct
The executable hash, such as a SHA-256 digest, is a deterministic value derived from the malware binary's exact byte sequence, so any system running an identical sample will produce the same hash. This makes it a precise and stable indicator of compromise, assuming the sample has not been repacked or modified, and it enables reliable hash-based hunting across all endpoints and forensic artifacts.
- ✗
The employee's home city where the alert was observed.
Why it's wrong here
The employee's home city is a geographic attribute of the victim's environment, not a forensic artifact of the malware itself. The same malware strain can be present on systems in any city, while an alert observed in that city could stem from unrelated malicious activity, so geolocation cannot serve as a consistent or queryable indicator for discovering other infected machines.
- ✗
The brand of the user's keyboard and mouse.
Why it's wrong here
Keyboard and mouse brand is hardware metadata that has no relationship to the malware's code, behavior, or network communications. Peripheral information is not stored in malware analysis artifacts, is not observable in packet captures or process memory, and provides no repeatable search criteria for detecting the campaign on other hosts, making it entirely irrelevant as an IOC.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
SHA-256
SHA-256 is a cryptographic hash function that takes any input data and produces a fixed 256-bit string of characters, like a unique digital fingerprint, used to verify data integrity and secure passwords.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.