7.1 Conduct Routine Active Hunt Operations Within Your Environment in Order to Determine If Your Environment Has Been Breached CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A hunt team plans a routine hunt for credential theft. They know that the environment uses single sign-on (SSO) and multi-factor authentication (MFA). Which planning step is most important to include to ensure the hunt is effective?

   • ADefine the hunt scope to include authentication logs from the SSO provider and endpoints, and establish a baseline of normal authentication patterns.
   • BSchedule the hunt only after a security incident occurs to avoid unnecessary work.
   • CPlan to disable MFA temporarily to simplify the hunt and reduce noise.
   • DFocus the hunt solely on endpoint logs because SSO logs are not useful for credential theft.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A hunt analyst is investigating a potential data exfiltration. They find that a large amount of data was transferred to an external IP over a short period. The analyst wants to determine if this is a breach. Which action best follows the hunt execution process?

   • AIgnore the transfer because it could be a backup job.
   • BConclude it is a breach because the data transfer is large and to an external IP.
   • CImmediately block the external IP and report the incident.
   • DCheck if the external IP is associated with a known cloud storage service used by the company and if the transfer matches normal business use.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following best describes the 'cadence' of a routine active hunt?

   • AThe specific hypothesis being tested during the hunt
   • BThe frequency at which the hunt is repeated, such as weekly or monthly
   • CThe severity level of threats being hunted for
   • DThe set of tools used to perform the hunt
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is it important to adapt hunt operations to the environment's known baseline behaviors?

   • ATo ensure the hunt uses the same procedures for every environment
   • BTo make the hunt faster by ignoring normal activity
   • CTo eliminate the need for threat intelligence
   • DTo reduce false positives by distinguishing normal activity from suspicious activity
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has a fleet of point-of-sale (POS) systems that run a specific operating system and have limited logging enabled. The hunt team wants to hunt for memory-scraping malware. How should they adapt the hunt to this environment?

   • AUse the available endpoint detection and response (EDR) telemetry and supplement with network traffic analysis to identify unusual data flows.
   • BRequest that all POS systems be replaced with newer ones that have full logging.
   • CRely solely on memory forensics, which is the only way to detect memory-scraping malware.
   • DSkip the hunt because the limited logging makes it impossible to detect memory-scraping malware.
   Reveal Solution Discussion Select an answer first