Threat intelligence note: - Delivery domains change daily using disposable VPS providers - File hashes vary because the payload is repacked for each campaign - Email lure wording changes weekly - The malware consistently creates a mutex named `Global\WkSvcHost_0F92` - One case also showed a registry key under `HKCU\Software\SysTools\Cache` but that key was not present in every sample
Based on the exhibit, which indicator should the security team prioritize for endpoint detection and hunting?
The attacker rotates infrastructure frequently, but one artifact has remained consistent across recent investigations.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
The current source IP addresses hosting the payloads
Those addresses are disposable and are expected to change rapidly, so they are weak long-term indicators.
The unique mutex name created by the malware on infected endpoints
The mutex is a host-based artifact that the malware consistently creates, making it a stronger and more durable detection point than rotating domains or repacked hashes.
The exact wording of the latest phishing email lure
The lure wording changes weekly, so it is useful for a single campaign but poor as a stable hunting indicator.
The filename of the attachment used in the most recent incident
Attachment names are easy for attackers to modify and are rarely a dependable indicator across campaigns.
Common exam trap
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Technical deep dive
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Read the scenario before looking for a memorised answer.
The correct answer is: The unique mutex name created by the malware on infected endpoints — The mutex is the best indicator to prioritize because it is a host-level artifact that remains consistent even when the attacker changes domains, hosting providers, email wording, and payload hashes. Those network and delivery indicators are explicitly described as changing, which makes them unreliable for long-term detection. A stable mutex is often a strong clue in endpoint telemetry and can be used for hunts, alerting, and IOC enrichment across multiple incidents. Why others are wrong: Current IPs and attachment names are easily changed and are therefore short-lived indicators. Email lure wording is valuable for awareness and email filtering, but the exhibit states it changes often, reducing its usefulness as a durable IOC. The mutex stands out because it is repeated across samples and is likely to appear on compromised systems regardless of the delivery method or repacking strategy.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.