Threat Hunting CSA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC is hunting for a ransomware attack that may have used a legitimate remote management tool (RMM) for lateral movement. The team has limited log storage and must choose which data sources to prioritize for the hunt. Which data source combination would provide the best balance of coverage and storage efficiency?

   • AOnly DNS logs and proxy logs.
   • BFull packet capture (PCAP) of all network traffic for the past 30 days.
   • CEDR telemetry and Windows Event Logs for process creation and network connections.
   • DOnly firewall logs and NetFlow data.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   During a hunt for data exfiltration, an analyst finds a series of events: a user downloads a large file from a SharePoint site, then uses a personal cloud storage app to upload it, and then deletes the local copy. The user has a history of legitimate large downloads. How should the analyst proceed?

   • ASearch for the file hash in the SIEM to see if it was previously flagged as malicious.
   • BImmediately disable the user's account and report to HR.
   • CClose the hunt because the user has a history of legitimate large downloads.
   • DTreat this as a potential IOA and investigate further, including checking if the user has a business need for the personal cloud app and whether the file was sensitive.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC team is tasked with hunting for an advanced persistent threat (APT) that is known to use fileless techniques and PowerShell for execution. The team has limited time and resources. Which hunting approach would be most efficient for detecting this APT?

   • ASearch for known malware file hashes across all endpoints.
   • BRun a full antivirus scan on all endpoints.
   • CFocus on PowerShell script block logging and EDR telemetry for suspicious PowerShell activity, such as encoded commands or unusual module loads.
   • DReview all outbound network connections for the past month.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC analyst is hunting for signs of credential dumping on Windows endpoints. The analyst has access to Sysmon logs, Windows Event Logs, and EDR telemetry. Which combination of data sources and queries would be most effective for detecting credential dumping behavior?

   • AQuery the firewall logs for outbound connections to unknown IPs.
   • BSearch Sysmon for process access events (Event ID 10) targeting lsass.exe, and correlate with EDR telemetry for suspicious process execution.
   • CSearch only Windows Event Logs for failed logon events (Event ID 4625).
   • DSearch for the presence of the file 'lsass.exe' on disk using file integrity monitoring.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why are endpoint logs considered a critical data source for threat hunting?

   • AThey are the only source of data that can detect network-based attacks
   • BThey are automatically encrypted and cannot be tampered with
   • CThey provide a record of user keystrokes and passwords
   • DThey contain detailed information about processes, file activity, and registry changes on the host
   Reveal Solution Discussion Select an answer first