Threat intelligence shows an attacker changes the domain name every day, but the malware file hash stays the same across incidents. What should defenders prioritize for blocking?

The daily domain names, because they are the easiest indicator to find.

Daily domains are useful for tracking activity, but they change frequently and are not the most stable block option in this scenario.

The color of the phishing email, because visual style is unique to the attacker.

Email appearance is not a reliable technical indicator, and color alone is not useful for blocking malware or infrastructure.

The user's browser homepage, because attackers often change it after infection.

Browser homepage changes may happen after infection, but they are a symptom, not a dependable indicator to block attacker activity.

What does this SY0-701 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: The malware file hash, because it remains consistent across incidents. — The best block candidate is the malware file hash because it is consistent across incidents and directly identifies the malicious payload. Domain names can rotate daily, so they are less durable as a defense control. A stable hash is often more useful for endpoint blocking, malware hunting, and retroactive searching across logs or security tools. Why others are wrong: Daily domains are real indicators, but they are volatile and intentionally changed by the attacker. Visual style is not a technical indicator with blocking value. A changed browser homepage is only a symptom and does not help defenders stop the actual malicious sample from spreading.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.