SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Threat intelligence reports that an adversary changes domains daily and uses disposable cloud hosting, but the malware binary hash and a unique mutex name remain unchanged across incidents. Which indicator is the best candidate for immediate detection rule creation?
⚠ Common exam trap
A common mix-up: candidates choose the 'easiest' or most visible indicator (domain names) without considering stability and false-positive risk, whereas the exam tests the principle that static, unique artifacts (like file hashes) are superior for detection rule creation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The malware file hash, because it directly identifies the reused sample.
The malware file hash (e.g., SHA-256) provides a static, deterministic identifier for the exact binary sample. Since the adversary reuses the same malware binary across incidents, the hash remains unchanged and can be used to create a precise detection rule (e.g., a YARA rule or hash-based IOC blocklist) that will reliably match the malicious file regardless of network-level churn like domain or IP changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The daily domain names, because they are the easiest items to collect.
Why it's wrong here
While domains can be collected quickly from a sandbox or DNS logs, they are designed to be transient: adversaries use fast-flux techniques, short TTLs, and domain generation algorithms (DGAs) to rotate them constantly. This volatility makes them unreliable for long-term detection because by the time a blocklist is updated, the next domain may already be in use for the same campaign. The ease of collection does not translate into detection value when the indicator changes faster than your response cycle.
- ✓
The malware file hash, because it directly identifies the reused sample.
Why this is correct
The file hash is the strongest immediate IOC here because the same malware sample is being reused across incidents. If the binary remains unchanged, the hash will match exactly and can be used for fast blocking or hunting. Volatile infrastructure such as domains and cloud hosting changes too frequently to serve as the primary detection point.
- ✗
The cloud provider name, because the attacker uses disposable infrastructure.
Why it's wrong here
The cloud provider name is a broad attribution attribute, not a precise indicator. Tens of thousands of legitimate organizations and unrelated malicious actors share the same IP address ranges, so blocking by provider would cause massive collateral damage and not distinguish this campaign. Even if the attacker uses disposable cloud infrastructure, the provider is not unique to them, and the specific IP or account would be far more relevant; the provider alone offers no actionable detection signal.
- ✗
The time of day the campaign was observed, because the attacker is consistent.
Why it's wrong here
Time-of-day patterns are behavioral context, not a unique artifact. Malware execution can be scheduled, manually triggered across time zones, or run on compromised hosts in different locales, so the observed time is not a stable or unique property of this attack. Even if a pattern appears consistent, it is not searchable like a file hash and cannot be used to block or detect the sample on an endpoint, making it a weak indicator at best.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A threat intelligence feed says an adversary rotates domains daily, uses cloud VPS hosting, and reuses the same malware sample across several campaigns. Analysts want the indicator that remains useful even when the domain changes. What should they prioritize?
medium- A.The current domain name because it is the easiest item to block immediately.
- ✓ B.The malware's SHA-256 file hash because it uniquely identifies the sample.
- C.The cloud provider's entire ASN because all traffic from that provider is automatically malicious.
- D.The malware's file name because attackers usually keep the same name for convenience.
Why B: The malware's SHA-256 file hash is the most persistent indicator because it is a cryptographic hash that uniquely identifies the specific binary sample, regardless of the domain or IP address used for delivery. Unlike domains or IPs, which the adversary can rotate daily, the hash remains constant as long as the same malware sample is reused across campaigns. This makes it a reliable indicator of compromise (IOC) for detection via file reputation or hash-based blocklists.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.