Question 545 of 1,013
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Threat intelligence note Campaign summary: - Malicious domains change every 24 hours - Executable file hash stays the same across samples - TLS certificate fingerprint remains: 4F:91:2C:AA:7D:10:88:6B:... - User agent string varies by host
Based on the exhibit, which indicator should defenders prioritize for detecting future activity from this campaign?
⚠ Common exam trap
The trap here is that candidates mistakenly prioritize easily changed artifacts like file hashes or domain names, overlooking the operational friction that makes TLS certificate fingerprints a more stable and attacker-resistant indicator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The TLS certificate fingerprint that remains constant across samples.
A TLS certificate fingerprint that remains constant across samples provides a stable, attacker-controlled indicator that is difficult for adversaries to change without incurring cost or operational friction. Unlike domain names or user agents, which can be rotated easily, TLS certificates require the attacker to generate or compromise a new private key and certificate, making the fingerprint a persistent and reliable detection signature for defenders.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The daily-changing domain names used by the campaign.
Why it's wrong here
Domain names generated by a DGA or fast-flux rotation are ephemeral by design; the exhibit shows they change every 24 hours, so a single domain can only provide a short-lived detection signal. While a domain may be sinkholed or blocklisted, the campaign simply advances to the next algorithmically generated name, making them poor candidates for sustained, proactive detection. They require continuous threat-intel feed updates and are best used for immediate triage, not as a cornerstone of detection strategy.
- ✗
The executable file hash that remains constant across samples.
Why it's wrong here
A file hash is a precise but brittle indicator: it uniquely identifies only the exact binary it was computed from. If the attacker repacks, recompiles, or appends even a single byte of junk data to the executable, the SHA-256 or MD5 hash changes completely, rendering the indicator useless for detecting future samples. Since the campaign likely uses polymorphic or self-modifying code, the hash that remains constant in the exhibit is still just one version of the malware, not a stable identifier of the underlying C2 infrastructure, so it cannot provide broad visibility across the campaign.
- ✓
The TLS certificate fingerprint that remains constant across samples.
Why this is correct
A stable TLS certificate fingerprint is a strong indicator because it can survive daily domain changes and still identify the same infrastructure or campaign. It is especially useful for network detection when other indicators rotate frequently, as shown in the exhibit.
- ✗
The changing user agent string seen on each host.
Why it's wrong here
User-Agent strings are located in the HTTP header and are trivially randomized or spoofed by the malware on a per-host or per-request basis, as the exhibit shows. They have no inherent tie to the attacker's infrastructure; they can be set to mimic legitimate browsers or rotated to evade signature-based detection. Consequently, a changing user agent is a high-variance, low-signal indicator that produces many false positives and is unsuitable as a primary detection mechanism, especially when compared to a stable TLS certificate fingerprint.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.