7.1 Conduct Routine Active Hunt Operations Within Your Environment in Order to Determine If Your Environment Has Been Breached CCFH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of defining the scope of a routine active hunt operation?

   • ATo determine the number of analysts required to complete the hunt
   • BTo set the expected completion date for the hunt
   • CTo establish the legal authority for conducting the hunt
   • DTo identify which systems and data sources will be examined during the hunt
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the role of iterative analysis in the hunt execution process?

   • ATo automate the entire hunt process from start to finish
   • BTo refine the hunt based on new findings and adjust the approach as needed
   • CTo ensure the hunt is completed in a single pass without changes
   • DTo eliminate the need for manual review of results
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During a routine hunt, an analyst collects process execution data from endpoints and notices an unusual pattern: a legitimate software updater spawns a PowerShell process that connects to an external IP. The analyst wants to test the hypothesis that this is malicious. Which next step best follows the systematic hunt execution process?

   • AImmediately quarantine the endpoint and block the external IP to contain the potential threat.
   • BCompare the observed behavior against the environment's baseline for that software updater and the external IP's reputation.
   • CDocument the finding as a false positive because the software updater is legitimate.
   • DExpand the search to all endpoints to see if any other systems show the same pattern.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's environment includes a mix of Windows servers, Linux workstations, and legacy systems that do not send all telemetry to the SIEM. The hunt team wants to run a routine hunt for lateral movement. What is the most appropriate way to adapt the hunt to this environment?

   • AUse only network traffic data because it is consistent across all systems.
   • BRun the hunt only on Windows servers because they are the most likely target for lateral movement.
   • CFocus the hunt on data sources that are available across all systems, such as authentication logs, and supplement with host-based data where telemetry exists.
   • DRequire all systems to send full telemetry to the SIEM before starting the hunt.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a breach determination indicator?

   • AA low disk space warning on a server
   • BA user logging in from a new device
   • CA known malicious file hash detected on a host
   • DA scheduled maintenance window
   Reveal Solution Discussion Select an answer first