7.1 Conduct Routine Active Hunt Operations Within Your Environment in Order to Determine If Your Environment Has Been Breached CCFH Practice Questions (Page 5)

Questions 21–23

1. 21expert · hard

   A security team plans a routine hunt for ransomware. The environment includes a mix of Windows and Linux servers, with some legacy systems that lack EDR coverage. The team has limited time and must balance coverage with thoroughness. Which plan best balances these constraints?

   • APrioritize Windows servers with EDR coverage, use network logs to cover legacy systems, and schedule the hunt in phases.
   • BDeploy EDR to all legacy systems before starting the hunt.
   • CHunt only Windows servers because ransomware primarily targets Windows.
   • DRun a single comprehensive hunt across all systems at once to save time.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A hunt analyst is investigating a potential breach. They find that a user account has been used to access a sensitive file share, and the user has no history of accessing that share. The access occurred during business hours. The analyst must decide if this is a breach. Which approach best follows the hunt execution process?

   • ACheck if the access correlates with a legitimate business need, such as a recent project or manager approval.
   • BConclude it is not a breach because the access occurred during business hours.
   • CConclude it is a breach because the user has no history of accessing the share.
   • DImmediately revoke the user's access to the share.
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A company has a development environment where developers frequently run scripts that download packages from the internet. The hunt team wants to hunt for malicious downloads. How should they tune the hunt to this environment?

   • ABlock all internet downloads in the development environment to eliminate the risk.
   • BOnly look for downloads from known malicious domains, ignoring other download activity.
   • CRun the same hunt as in production, since download behavior is similar.
   • DEstablish a baseline of normal download behavior for developers and alert on deviations, such as downloads from known malicious domains or unusual times.
   Reveal Solution Discussion Select an answer first