An Incident Responder Is Going to Run an Indicators of Compromise

question 302

Multiple Choice

An Incident Responder is going to run an indicators of compromise (IOC) search on the endpoints and wants to use operators in the expression. Which tokens accept one or more of the available operators when building an expression?

• A) All tokens
• B) Domainname, Filename, and Filehash
• C) Filename, Filehash, and Registry
• D) Domainname and Filename only

---

Definitions:

Fat Client

A computer that performs the bulk of data processing operations itself, rather than relying on a server, characterized by its significant local storage, processing power, and software functionality.

Many Functions

A term that denotes software or devices featuring a wide range of capabilities or features designed to perform multiple tasks.

Network Connection

A link between two or more devices that allows them to communicate or share data.

The ALU

The part of the computer that is responsible for performing mathematical calculations and logical operations, central to the CPU's function.