SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Threat intelligence note: - Delivery domains change daily using disposable VPS providers - File hashes vary because the payload is repacked for each campaign - Email lure wording changes weekly - The malware consistently creates a mutex named `Global\WkSvcHost_0F92` - One case also showed a registry key under `HKCU\Software\SysTools\Cache` but that key was not present in every sample
Based on the exhibit, which indicator should the security team prioritize for endpoint detection and hunting?
The attacker rotates infrastructure frequently, but one artifact has remained consistent across recent investigations.
⚠ Common exam trap
The trap here is that candidates focus on easily changed artifacts (IPs, filenames, email content) rather than recognizing that mutexes are often hardcoded in malware binaries and persist across infrastructure changes, making them a more stable indicator for detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The unique mutex name created by the malware on infected endpoints
A mutex (mutual exclusion object) is a unique artifact created by malware to prevent multiple instances of itself from running on the same endpoint. Since the attacker rotates infrastructure frequently (IPs, domains, filenames), the consistent mutex name provides a stable indicator of compromise (IoC) that can be used for endpoint detection and hunting across different incidents. This makes it a reliable signature for identifying the same malware family or variant even when other indicators change.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The current source IP addresses hosting the payloads
Why it's wrong here
Current source IP addresses are ephemeral network infrastructure—often compromised hosts, bulletproof hosting, or fast-flux nodes—that can change within minutes after a campaign launches. While valuable for immediate perimeter blocking, they are not tied to the malware's code or persistent host behavior, so they decay quickly as long-term indicators. Threat hunters should prioritize artifacts that survive infrastructure rotation and repacking.
- ✓
The unique mutex name created by the malware on infected endpoints
Why this is correct
A mutex (mutual exclusion object) is a named synchronization primitive that malware creates to prevent multiple instances of itself from running simultaneously. The name is frequently hardcoded or derived from a fixed algorithm in the binary, so it remains consistent across downloads and executions on infected endpoints. Unlike network addresses or file names, this host-based artifact can be queried via EDR tools or Sysinternals and provides a durable detection point that persists even after domains, IPs, and hashes rotate.
- ✗
The exact wording of the latest phishing email lure
Why it's wrong here
Phishing lure wording is purely social engineering content—subject lines, body text, and call-to-action language are routinely altered for each campaign, target organization, or even individual recipient. Threat actors A/B test these phrases to optimize click-through rates, so the exact wording is ephemeral and has no inherent link to the malware's technical behavior. Relying on it as a hunting indicator produces high false positives and false negatives; instead, extract stable technical artifacts like attachment hashes or embedded URLs, though those also change.
- ✗
The filename of the attachment used in the most recent incident
Why it's wrong here
Attachment filenames are arbitrary labels chosen by the attacker for the specific delivery moment—they can be renamed with trivial effort to appear innocuous or to match the target's expectations. A single malicious document can be distributed under hundreds of different filenames, and attackers often employ double extensions or Unicode spoofing to evade filters. Consequently, filenames are not a dependable indicator across incidents; they reflect the delivery wrapper, not the payload's code or behavior, and are easily modified without altering the malware itself.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.