SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Threat intelligence shows an attacker changes the domain name every day, but the malware file hash stays the same across incidents. What should defenders prioritize for blocking?
⚠ Common exam trap
It's easy for candidates to assume domain names are the easiest to block because they are visible in logs, but the question tests the principle of prioritizing stable, consistent indicators over ephemeral ones, and CompTIA often tests this by contrasting static hashes with dynamic domains in fast-flux scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The malware file hash, because it remains consistent across incidents.
The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a static, deterministic value derived from the malware's binary content. Since the attacker reuses the same malware across incidents, the hash remains consistent, making it a reliable indicator of compromise (IOC) for blocking via hash-based allow/deny lists in endpoint protection or network security controls. In contrast, domain names change daily (fast flux), so blocking them is less sustainable and requires constant updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The daily domain names, because they are the easiest indicator to find.
Why it's wrong here
Daily domain names are easy to find because they change frequently and can be observed in DNS logs, but that very transience makes them poor blocking indicators. By the time a defender aggregates and distributes the indicator, the attacker has already rotated to a new domain, allowing the campaign to continue. Furthermore, domains can be sinkholed or reused across different malware families, so blocking a single domain provides only short-lived and potentially noisy coverage.
- ✓
The malware file hash, because it remains consistent across incidents.
Why this is correct
A malware file hash is a deterministic cryptographic fingerprint computed over the entire binary; a given sample will produce the same hash value unless the attacker modifies a single byte. This stability makes hashes an excellent indicator for detecting and blocking known malicious artifacts across multiple incidents, even when the attacker changes domains, IPs, or phishing lures. However, attackers can use packing or recompilation to alter a hash, so it should be used in conjunction with other indicators.
- ✗
The color of the phishing email, because visual style is unique to the attacker.
Why it's wrong here
The color of a phishing email is part of the visual presentation controlled by the sender, not a technical property of the underlying MIME structure or SMTP headers. Attackers can trivially change color schemes between campaigns or mix styles from legitimate brands, so it has no predictive value for detecting or blocking the malware itself. Visual style is not an IOC and cannot be used for automated security control rules.
- ✗
The user's browser homepage, because attackers often change it after infection.
Why it's wrong here
A user's browser homepage can be changed by certain malware after infection, but that is a post-exploitation side effect, not a stable artifact of the attacker's infrastructure or toolkit. The homepage setting is local to the compromised machine, varies by user configuration, and can be reset by the user; therefore it is not a reliable IoC for identifying other affected systems or blocking the attacker's future activity. It might be a symptom to remediate, but it does not help stop the campaign at the network or endpoint control layer.
Go deeper
Related to this question
Learn chapter
Malware Types and Characteristics
Key term
Terminal Access Controller Access-control System
TACACS+ is a remote authentication protocol that uses three separate servers to verify who you are, what you are allowed to do, and record what you did on network devices.
Key term
Denial-of-service
A Denial-of-service (DoS) attack is an attempt to make a computer, network, or online service unavailable to its intended users by overwhelming it with fake traffic or requests.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Threat intelligence shows an attacker changes domains every day, but the malware file itself stays the same across incidents. Which indicator would be the best to block immediately if you find it in your environment?
easy- A.The current weather in the city where the attack was observed
- ✓ B.The malware file hash from the shared sample
- C.The logo used on the phishing email
- D.The time zone used by the help desk
Why B: The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a unique fingerprint of the file's binary content. Since the malware file itself remains unchanged across incidents, its hash is a static, reliable indicator of compromise (IoC) that can be immediately blocked via file reputation or hash-based detection rules, regardless of domain changes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.