A threat intelligence feed provides a list of malicious IP addresses and file hashes associated with a recent campaign. A SOC analyst wants to proactively search the environment for any signs of this campaign. Which approach is most appropriate?

Wait for the SIEM correlation rules to match the IOCs and generate alerts.

Add the IPs and hashes to a blocklist and assume the environment is clean if no new alerts fire.

Search only for the file hashes in the EDR console, ignoring network indicators.

Query the SIEM for any network connections to the listed IPs and any file executions matching the hashes.

Which of the following is an example of an Indicator of Compromise (IOC)?

The number of employees in the company

What is a common hunting technique for detecting ransomware activity?

Looking for an increase in employee login attempts

Checking for unused software licenses

Searching for mass file encryption events and unusual file extension changes

Monitoring for changes in the company's stock price

After completing a threat hunt that found no malicious activity, a SOC analyst is preparing the final report. The hunt hypothesis was that a specific APT group might be using living-off-the-land binaries (LOLBins) for lateral movement. What should the analyst include in the report to ensure the hunt is valuable for future efforts?

List all the IOCs that were searched and mark the hunt as closed.

Document the hypothesis, the data sources queried, the specific queries used, and the rationale for why the hunt was considered negative.

Delete the hunt data to free up storage space, as no threat was found.

Only record the final conclusion that no threat was found, since the hunt is complete.

How are IOCs typically used in threat hunting?

To search logs and system artifacts for matches that may indicate a compromise

To automatically patch vulnerabilities in the system

To replace the need for threat intelligence feeds

To create new user accounts for the SOC team

EC-CouncilCertified SOC Analyst

Domain 5Objective 2

Threat Hunting CSA Practice Questions (Page 5)

Part of the Proactive Threat Detection domain, which makes up ~14% of our current practice bank.

49questions here

10free pages

10concepts

Questions 21–25

21application · medium
A threat intelligence feed provides a list of malicious IP addresses and file hashes associated with a recent campaign. A SOC analyst wants to proactively search the environment for any signs of this campaign. Which approach is most appropriate?
Select an answer first
22foundation · easy
Which of the following is an example of an Indicator of Compromise (IOC)?
Select an answer first
23foundation · easy
What is a common hunting technique for detecting ransomware activity?
Select an answer first
24application · medium
After completing a threat hunt that found no malicious activity, a SOC analyst is preparing the final report. The hunt hypothesis was that a specific APT group might be using living-off-the-land binaries (LOLBins) for lateral movement. What should the analyst include in the report to ensure the hunt is valuable for future efforts?
Select an answer first
25foundation · easy
How are IOCs typically used in threat hunting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.