MENU
An employee abused PowerShell commands and script interpreters, which lead to an indicator of compromise (IOC) trigger. The IOC event shows that a known malicious file has been executed, and there is an increased likelihood of a breach. Which indicator generated this IOC event?
Suggested Answer: D
Get Premium 350-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
23 comments · newest first
WA
Wava
2 days ago
D seems off. Not really about malware execution.
VA
Val
7 days ago
C could be a factor, but not as direct as A.
ST
Stephen
12 days ago
Definitely A. It directly relates to malware execution.
UL
Ulysses
17 days ago
B is also a possibility, but A feels stronger.
DO
Dominque
22 days ago
I agree, A makes sense. Malicious file executed.
EL
Elena
27 days ago
I think it's A) ExecutedMalware.ioc. Seems most relevant.
RO
Rosendo
1 month ago
Overall, A seems to cover the IOC event best.
TA
Tammy
1 month ago
D) W32 AccesschkUtility.ioc is less likely. Not malware focused.
FE
Felix
1 month ago
I feel like A is the strongest choice. Clear indicator of a breach.
RE
Reita
2 months ago
C) ConnectToSuspiciousDomain.ioc could also apply if they connected to a bad site.
MA
Marilynn
2 months ago
True, but A is more direct for this scenario.
DO
Dottie
2 months ago
But what about B) Crossrider.ioc? It's known malware too.
KI
Kirby
2 months ago
I agree, A makes sense. Malicious file executed.
CY
Cyril
2 months ago
I think it's A) ExecutedMalware.ioc. Seems most relevant.
CY
Cyndy
2 months ago
I’m surprised this happened with PowerShell. Isn’t it supposed to be secure?
LI
Linn
3 months ago
Wait, are we sure it’s not D) W32 AccesschkUtility.ioc? That’s a bit odd.
AN
Anjelica
3 months ago
C) ConnectToSuspiciousDomain.ioc seems plausible too.
LO
Lonny
3 months ago
I think it could be B) Crossrider.ioc. Not so sure about A.
GA
Gary
3 months ago
Definitely A) ExecutedMalware.ioc. Makes sense!
YA
Yan
3 months ago
I’m leaning towards ExecutedMalware.ioc, but I’m not completely confident. The other options seem plausible too.
PO
Pok
3 months ago
I think the IOC is likely related to executed malware, but I wonder if the suspicious domain could also be a factor.
HI
Hildred
4 months ago
I feel like I've seen a question like this before. Crossrider sounds familiar, but I can't recall if it was specifically about PowerShell abuse.
ST
Stephane
4 months ago
I remember studying IOC events, but I'm not entirely sure which one fits here. I think it might be related to executed malware.