Threat Hunting CSA Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   What is the key difference between an Indicator of Attack (IOA) and an Indicator of Compromise (IOC)?

   • AIOAs are always more reliable than IOCs
   • BIOAs are only used for network-based attacks, while IOCs are only for endpoint attacks
   • CIOAs focus on the intent and sequence of actions, while IOCs are specific artifacts left behind
   • DIOAs are based on static artifacts, while IOCs are based on behavior
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An advanced persistent threat (APT) is known to use living-off-the-land binaries (LOLBins) like certutil.exe to download payloads. A SOC analyst wants to hunt for this activity in an environment where many legitimate administrative scripts also use certutil.exe. Which hunting approach would best reduce false positives while still detecting the APT?

   • ASearch for the specific APT's known command-line arguments for certutil.exe.
   • BSearch for all executions of certutil.exe in the last 90 days.
   • CBlock certutil.exe from running on all endpoints.
   • DCorrelate certutil.exe executions with outbound network connections to unusual destinations or non-standard ports.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   How does threat hunting differ from traditional security monitoring?

   • AThreat hunting is performed only after a breach is confirmed, while monitoring is performed continuously
   • BThreat hunting uses only automated tools, while monitoring relies on manual analysis
   • CThreat hunting is a proactive search for unknown threats, while monitoring focuses on detecting known threats through alerts
   • DThreat hunting is reactive and triggered by alerts, while monitoring is proactive and continuous
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the primary goal of threat hunting in a SOC environment?

   • ATo replace traditional security monitoring with automated detection
   • BTo proactively identify hidden or undetected malicious activity that evades existing security controls
   • CTo respond to alerts generated by SIEM and other monitoring tools
   • DTo ensure compliance with regulatory requirements by generating reports
   Reveal Solution Discussion Select an answer first