Threat Hunting CSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which tool is commonly used to query and analyze log data during a threat hunt?

   • ASpreadsheet application
   • BSIEM platform
   • CWord processor
   • DEmail client
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A threat intelligence report provides a list of file hashes associated with a new malware strain. A SOC analyst runs a hunt and finds one hash on a single endpoint. However, the file is digitally signed by a legitimate vendor and the hash is not in the endpoint's threat database. What should the analyst do next?

   • AAdd the hash to the blocklist and move on to the next hunt.
   • BIgnore the finding because the file is signed by a legitimate vendor.
   • CImmediately quarantine the endpoint and report the finding as a confirmed compromise.
   • DValidate the finding by checking the file's reputation, behavior, and related network connections before declaring it malicious.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During a hunt for lateral movement, an analyst notices a sequence of events on multiple workstations: a scheduled task created on one host, followed by an RDP connection to a server, followed by the creation of a service on that server. No known malware signatures are detected. Which hunting approach would be most effective at identifying this activity as malicious?

   • ACorrelate the sequence of events across hosts to identify a behavioral pattern consistent with lateral movement.
   • BIsolate the first workstation and reimage it to prevent further spread.
   • CCheck the RDP server's event logs for failed login attempts.
   • DSearch for the specific scheduled task name across all systems to see if it is unique.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After completing a threat hunt that found no evidence of the hypothesized APT activity, a SOC analyst needs to document the results. What is the most important element to include in the hunt report?

   • AA recommendation to disable the SIEM queries because they did not produce results.
   • BA list of all IOCs from the threat intelligence feed, even if they were not found in the environment.
   • CThe hypothesis, data sources queried, search logic, and the conclusion that no indicators were found.
   • DA summary of the threat intelligence report that motivated the hunt.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the role of endpoint detection and response (EDR) tools in threat hunting?

   • ATo manage user access permissions
   • BTo provide deep visibility into endpoint activities and enable remote investigation and response
   • CTo replace the need for network monitoring tools
   • DTo automatically patch all vulnerabilities on endpoints
   Reveal Solution Discussion Select an answer first