Threat Hunting CSA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC analyst is about to start a threat hunt for lateral movement using pass-the-hash techniques. The analyst has a hypothesis and has identified relevant data sources. What should the analyst do immediately after collecting the data?

   • AAnalyze the data for patterns that match the hypothesis, such as anomalous logon events from one host to many others.
   • BImmediately block all SMB traffic to prevent lateral movement.
   • CDocument the data collection process and then close the hunt.
   • DShare the raw data with all SOC team members for manual review.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC is hunting for an insider threat who may be using legitimate administrative tools to perform unauthorized actions. The hunt must avoid generating false positives that would disrupt legitimate admin work. Which hunting approach best balances detection and false-positive reduction?

   • ABlock all administrative tools that are not on an approved list.
   • BBaseline normal administrative behavior and then hunt for deviations, such as an admin using a tool outside of their normal hours or on systems they don't usually access.
   • CSearch for known IOCs associated with malicious activity, such as specific file hashes.
   • DSearch for all usage of administrative tools across the environment and alert on every instance.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC manager wants to implement a proactive threat hunting program. The team currently relies on alerts from the SIEM and EDR. Which of the following best describes the key difference between threat hunting and traditional security monitoring that the manager should consider?

   • AThreat hunting is only performed after a security incident is confirmed.
   • BThreat hunting uses the same tools as monitoring but requires more staff.
   • CThreat hunting focuses only on known IOCs, while monitoring focuses on behavior.
   • DThreat hunting is proactive and assumes a breach may already exist, while traditional monitoring is reactive and waits for alerts.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What should be included in a threat hunting report to effectively communicate results to management?

   • AA summary of the hypothesis, key findings, and recommended actions
   • BThe source code of any malware discovered
   • CThe personal opinions of the analysts about the threat landscape
   • DA detailed list of every log entry reviewed during the hunt
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the correct sequence of steps in the threat hunting process?

   • ADocument results, form a hypothesis, collect data, and validate findings
   • BCollect data, form a hypothesis, validate findings, and document results
   • CForm a hypothesis, collect data, validate findings, and document results
   • DValidate findings, form a hypothesis, collect data, and document results
   Reveal Solution Discussion Select an answer first