7.1 Conduct Routine Active Hunt Operations Within Your Environment in Order to Determine If Your Environment Has Been Breached CCFH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of applying defined criteria and indicators when determining if a breach has occurred?

   • ATo ensure the determination is consistent and based on evidence
   • BTo speed up the hunt by skipping detailed analysis
   • CTo replace the need for human judgment
   • DTo automatically remediate any detected threats
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In the systematic hunt process, what is the purpose of hypothesis testing?

   • ATo validate or refute a potential threat scenario using collected data
   • BTo replace the need for data collection
   • CTo automatically remediate any detected threats
   • DTo generate a list of all possible threats in the environment
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A hunt analyst is investigating a potential breach. They find that a legitimate admin tool is being used to create a new local admin account on multiple servers. The tool is commonly used by IT for maintenance. The analyst must decide if this is a breach. Which approach best follows the hunt execution process?

   • AImmediately disable the tool and reset all local admin passwords.
   • BCorrelate the account creation with change-management tickets and check if the tool's usage pattern matches normal IT behavior.
   • CConclude it is a breach because creating local admin accounts is a common persistence technique.
   • DConclude it is not a breach because the tool is legitimate and used by IT.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team wants to implement routine active hunts but has a small team and a large environment. They need to decide on a cadence and scope that is sustainable. Which approach best balances thoroughness with resource constraints?

   • AHunt only when a new threat is announced to save resources.
   • BHunt only the most critical servers every week, ignoring other systems.
   • CSchedule hunts on a rotating basis, focusing on different high-risk systems each cycle, and document findings to build a baseline.
   • DRun a comprehensive hunt of the entire environment once a year.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team wants to implement routine active hunts but has limited resources. They need to prioritize which systems to hunt first. Which prioritization approach is most aligned with routine active hunt planning?

   • AHunt all systems equally, regardless of their criticality, to ensure complete coverage.
   • BHunt only systems that have had recent security incidents.
   • CPrioritize systems that contain sensitive data or are critical to business operations, and schedule hunts based on risk.
   • DPrioritize systems that are easiest to hunt, such as those with the most telemetry.
   Reveal Solution Discussion Select an answer first