A SOC analyst at a financial firm notices a spike in outbound DNS queries to a domain recently flagged by threat intelligence as a C2 infrastructure. The analyst wants to proactively search for any hosts that may have communicated with this domain before the intelligence was published. Which approach best aligns with hypothesis-driven threat hunting?

Query the SIEM for all DNS logs containing the flagged domain and correlate with proxy logs to identify any internal hosts that resolved it, regardless of whether a connection was established.

Block the domain at the firewall and wait for alerts from the IDS to see if any internal hosts attempt to connect to it.

Review only the most recent 24 hours of endpoint detection and response (EDR) alerts for any process making outbound connections.

Search the SIEM for any event logs containing the domain string, but only for the past hour to reduce noise.

What does the acronym TTP stand for in the context of threat hunting?

Tactics, Techniques, and Procedures

Timing, Testing, and Prevention

Which of the following is an example of an Indicator of Attack (IOA)?

A registry key associated with a known backdoor

A suspicious domain name in a DNS log

A sequence of events showing privilege escalation after initial access

A file hash matching a known malware sample

A SOC team is planning a hunt for data exfiltration by an insider threat. The hunt must detect large, unusual outbound transfers without relying on endpoint agents. Which data source combination would be most effective for this hunt?

Authentication logs and VPN logs

EDR telemetry and process creation logs

Windows Event Logs and Sysmon logs

Proxy logs, firewall logs, and DNS logs

A SOC team has completed a hunt that identified a new malware variant. The team wants to ensure that the findings are useful for future hunts and for improving detection. Which action would be most effective?

Add the malware's file hash to the blocklist and close the case.

Create a detailed report that includes the hypothesis, data sources, queries, and the new TTPs observed, and share it with the detection engineering team.

Delete the hunt data to avoid clutter in the SIEM.

Only inform the incident response team and take no further action.

EC-CouncilCertified SOC Analyst

Domain 5Objective 2

Threat Hunting CSA Practice Questions (Page 2)

Part of the Proactive Threat Detection domain, which makes up ~14% of our current practice bank.

49questions here

10free pages

10concepts

Questions 6–10

6application · medium
A SOC analyst at a financial firm notices a spike in outbound DNS queries to a domain recently flagged by threat intelligence as a C2 infrastructure. The analyst wants to proactively search for any hosts that may have communicated with this domain before the intelligence was published. Which approach best aligns with hypothesis-driven threat hunting?
Select an answer first
7foundation · easy
What does the acronym TTP stand for in the context of threat hunting?
Select an answer first
8foundation · easy
Which of the following is an example of an Indicator of Attack (IOA)?
Select an answer first
9application · medium
A SOC team is planning a hunt for data exfiltration by an insider threat. The hunt must detect large, unusual outbound transfers without relying on endpoint agents. Which data source combination would be most effective for this hunt?
Select an answer first
10expert · hard
A SOC team has completed a hunt that identified a new malware variant. The team wants to ensure that the findings are useful for future hunts and for improving detection. Which action would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.