Analysts see a malware campaign that changes its command-and-control domain every day, but the executable hash and a unique registry value remain the same across incidents. Which indicator is the best candidate for hunting?

The daily domain name used for command and control.

Domains change often in this campaign, so the indicator will not stay reliable.

The employee's home city where the alert was observed.

Victim location is not a reliable indicator for finding the malware on other systems.

The brand of the user's keyboard and mouse.

Peripheral hardware does not help identify or track the malware campaign across incidents.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: The executable hash from the malware sample. — The executable hash is the best hunting indicator because it remains stable across incidents when the malware binary does not change. In this scenario, the attacker rotates command-and-control domains to evade blocking, so the domain is not a dependable long-term indicator. A file hash, on the other hand, is specific enough to support detection and can be used in endpoint and threat-hunting workflows when the same malicious file reappears. Why others are wrong: The daily domain is intentionally changing, so it is a poor long-term hunting target. The employee's city is just contextual information about where an alert appeared, not a reusable indicator of compromise. Keyboard and mouse brand have no meaningful relationship to the malware and would not help defenders identify the campaign.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.