Threat Hunting CSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat intelligence feed provides a list of file hashes associated with a new ransomware strain. The SOC wants to proactively determine if any of these hashes exist in the environment. Which approach is most effective for this hunt?

   • AWait for the antivirus to update its signatures and then check for alerts.
   • BRun a vulnerability scan across all systems to identify missing patches that could allow ransomware.
   • CReview firewall logs for any connections to known ransomware C2 domains.
   • DSearch the SIEM for file hash values across endpoint logs and also query the EDR platform for any file executions matching those hashes.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization has seen a rise in phishing emails that contain malicious macros. The SOC wants to proactively hunt for any hosts that may have executed macros from such emails, even if the payload was later deleted. Which hunting technique would be most effective?

   • ACheck the antivirus logs for any detections of the specific malware family.
   • BSearch for the exact subject lines of the phishing emails in the email gateway logs.
   • CLook for any files with a .docm extension on file shares.
   • DSearch for Office applications spawning PowerShell or WMI processes in endpoint logs, which is a common TTP for macro-based attacks.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a hunting approach specifically for detecting insider threats?

   • AAnalyzing firewall logs for port scans
   • BMonitoring for unusual access patterns, such as an employee accessing files at odd hours or downloading large volumes of data
   • CChecking for unpatched software vulnerabilities
   • DSearching for known malware signatures on the network
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SOC analyst is planning a hunt for credential dumping. The analyst has access to Windows Security logs, Sysmon logs, and network flow logs. Which sequence of steps best follows the systematic threat hunting process?

   • AStart by searching for known credential-dumping tool hashes, then form a hypothesis based on the results.
   • BCollect all logs from the last year, run a broad search for 'lsass', and report any hits.
   • CImmediately quarantine any system that shows a process accessing lsass.exe.
   • DForm a hypothesis about credential dumping techniques, collect relevant logs (e.g., Sysmon for process access), analyze for patterns, and validate any findings.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is knowledge of adversary TTPs valuable for threat hunting?

   • AIt guarantees that all threats will be detected
   • BIt helps the hunter search for behaviors and patterns that indicate a specific adversary's methods
   • CIt allows the hunter to predict the exact date and time of an attack
   • DIt eliminates the need for log analysis
   Reveal Solution Discussion Select an answer first