Exam CS0-003 topic 1 question 315 discussion

Actual exam question from CompTIA's CS0-003

Question #: 315
Topic #: 1

A list of IoCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost.exe. Which of the following best describes the result if security teams add this indicator to their detection signatures?

A. This indicator would fire on the majority of Windows devices.
B. Malicious files with a matching hash would be detected.
C. Security teams would detect rogue svchost.exe processes in their environment.
D. Security teams would detect event entries detailing execution of known-malicious svchost.exe processes.

Show Suggested Answer

Suggested Answer: A 🗳️

by erfanse at March 29, 2025, 7:22 p.m.

Comments

Submit Cancel

BadoBully

2 months, 4 weeks ago

Selected Answer: A

Only one that makes sense

upvoted 2 times

...

ada26b1

3 months ago

Selected Answer: A

I believe it is A can someone confirm ?

upvoted 1 times

...

erfanse

3 months ago

Selected Answer: B

This is because the SHA-256 hash is a unique identifier for a specific file. If the indicator contains the hash of svchost.exe, it would help identify any malicious files with the same hash that have been altered or injected with malware. However, svchost.exe is a legitimate Microsoft binary, and unless modified with malicious intent, it wouldn’t trigger alerts on its own.

upvoted 1 times

...