Question 841 of 1,013
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Threat intelligence shows an attacker changes domains every day, but the malware file itself stays the same across incidents. Which indicator would be the best to block immediately if you find it in your environment?
⚠ Common exam trap
The trap here is that candidates may focus on the attacker's changing domains (a dynamic indicator) and overlook the static file hash, which is the most reliable and immediately actionable indicator when the malware binary is unchanged.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The malware file hash from the shared sample
The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a unique fingerprint of the file's binary content. Since the malware file itself remains unchanged across incidents, its hash is a static, reliable indicator of compromise (IoC) that can be immediately blocked via file reputation or hash-based detection rules, regardless of domain changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The current weather in the city where the attack was observed
Why it's wrong here
Weather conditions in the observed city have no causal, temporal, or artifact-based relationship to the malware's behavior or infrastructure. Threat intelligence correlation relies on stable, measurable indicators such as IP addresses, hashes, or domain names, not atmospheric data. Including weather would introduce random noise and provide no actionable data for detecting, blocking, or attribute malicious activity.
- ✓
The malware file hash from the shared sample
Why this is correct
A cryptographic file hash, such as SHA-256, acts as a unique fingerprint of the malware binary itself. Even if the attacker dynamically rotates C2 domains or hosting infrastructure daily, the executable code typically remains identical for a given sample, so its hash stays constant. This makes the hash a reliable and persistent indicator of compromise that can be used to block execution, scan endpoints, and share intelligence across security tools.
- ✗
The logo used on the phishing email
Why it's wrong here
A logo is a superficial, easily replaced graphic that can be swapped in a phishing kit without altering the underlying malicious payload or infrastructure. Unlike a file hash, it is not a forensic artifact that uniquely identifies malware, and attackers routinely change logos to evade brand-based or OCR-based filters. Security controls do not reliably hash or track logos, so using one as an IOC produces little to no defensive value.
- ✗
The time zone used by the help desk
Why it's wrong here
A time zone is merely a configuration attribute of an endpoint or log source, and it does not originate from or uniquely identify the malware sample. Attackers can intentionally spoof timestamps or operate across multiple time zones, and many unrelated benign systems share the same zone setting. Therefore, a time zone cannot be used as an indicator of compromise or to correlate events to a specific threat actor or campaign.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.