ISC2 CC Security Operations Practice Question
A security analyst is reviewing network logs to detect potential intrusions. Which TWO of the following are examples of network-based indicators of compromise? (Choose two.)
⚠ Common exam trap
The trap here is conflating host-based indicators, such as failed logins or new accounts, with network-based indicators, which specifically involve traffic and communications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multiple connections to a command-and-control server
Network-based indicators of compromise are observable in network traffic, such as unusual outbound connections to malicious IPs or multiple connections to command-and-control servers. These suggest active communication with attacker infrastructure. Host-based indicators, like failed logins or new accounts, are found on individual systems and are not network-based.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Multiple connections to a command-and-control server
Why this is correct
Multiple connections to a command-and-control server are a clear network-based indicator of compromise. This behavior often indicates that compromised hosts are receiving instructions or sending data to an attacker-controlled server. It is typically detected through network traffic analysis and is a strong sign of an active intrusion.
- ✗
A file with a suspicious hash value found in a user's download folder
Why it's wrong here
A file with a suspicious hash value is a host-based indicator, typically discovered through endpoint detection or antivirus scans. It is not a network-based indicator. Network-based indicators focus on traffic patterns, such as unusual protocols or destinations.
- ✓
Unusual outbound traffic to a known malicious IP address
Why this is correct
Unusual outbound traffic to a known malicious IP address is a strong network-based indicator of compromise. It suggests a system may be communicating with a command-and-control server or exfiltrating data. This type of indicator is often detected through network monitoring tools and can trigger further investigation.
- ✗
A new local administrator account created on a workstation
Why it's wrong here
A new local administrator account is a host-based indicator, often found in system logs. It may indicate privilege escalation, but it is not a network-based indicator. Network-based indicators involve traffic and communications, not local account changes.
- ✗
A sudden increase in failed login attempts on a user account
Why it's wrong here
A sudden increase in failed login attempts is a host-based or application-based indicator, often seen in authentication logs. It may indicate a brute-force attack, but it is not a network-based indicator. Network-based indicators focus on traffic patterns, protocols, and communications.
Go deeper
Related to this question
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.