7.1 Conduct Routine Active Hunt Operations Within Your Environment in Order to Determine If Your Environment Has Been Breached CCFH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a routine hunt, an analyst finds a series of failed logon attempts followed by a successful logon from a foreign IP address. The successful logon occurred outside business hours. According to the hunt execution process, what should the analyst do next?

   • ACorrelate the successful logon with other activity from the same IP and check if any post-logon actions were performed.
   • BIgnore the finding because failed logons are common and the successful logon could be legitimate.
   • CReport the finding as a confirmed breach because the logon came from a foreign IP.
   • DReset the user's password and move on to the next hunt item.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of an environment-specific data source that a hunter might use to tune their hunt?

   • APublicly available vulnerability databases
   • BStandard operating system event logs
   • CCustom application logs that are unique to the organization's software
   • DGeneric threat intelligence feeds
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a highly regulated environment where data residency is required. The hunt team wants to use a cloud-based SIEM for log analysis, but they are concerned about data leaving the region. How should they adapt the hunt operations to meet both security and compliance needs?

   • AConfigure the SIEM to use a region that meets data residency requirements and ensure that all log data is stored and processed within that region.
   • BUse an on-premises SIEM only, because cloud-based SIEMs cannot meet data residency requirements.
   • CSkip the cloud SIEM and use manual log analysis to avoid compliance issues.
   • DSend all logs to the cloud SIEM and rely on encryption to protect data in transit.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team conducts weekly active hunts. They want to focus on a specific business unit that handles intellectual property, but they are concerned about alert fatigue from the noise generated by routine administrative activity. Which approach best aligns with routine active hunt planning while minimizing noise?

   • ADefine a hunt objective for the business unit, scope the hunt to its critical assets, and schedule it during a maintenance window when administrative activity is low.
   • BCreate a new detection rule that blocks all administrative activity in the business unit to reduce noise.
   • CRun a broad hunt across the entire environment using default detections to ensure nothing is missed, regardless of noise.
   • DWait for an alert to trigger before starting a hunt in the business unit to avoid unnecessary work.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A hunt analyst finds that an endpoint has a registry key modification that adds a new run key pointing to a suspicious executable. The executable is not signed and has a low prevalence in the environment. According to breach determination criteria, what is the most appropriate conclusion?

   • AThis is not a breach because the executable is not signed, but that is common for legitimate software.
   • BThis is a potential breach indicator because persistence mechanisms and unsigned executables are common signs of compromise.
   • CThis is not a breach because the executable has low prevalence, which is normal for new software.
   • DThis is a confirmed breach because the registry key modification is a definitive indicator.
   Reveal Solution Discussion Select an answer first