Threat Hunting CSA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Why is documentation an important part of the threat hunting process?

   • AIt helps improve future hunts by capturing lessons learned and successful techniques
   • BIt is required by law in all countries
   • CIt allows the SOC to prove to management that the hunting team is busy
   • DIt replaces the need for threat intelligence
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC analyst at a financial firm reads a threat intelligence report about a new banking trojan that uses PowerShell to download a second-stage payload from a legitimate cloud storage service. The analyst wants to proactively search the environment for signs of this activity before any alerts fire. Which approach best aligns with hypothesis-driven threat hunting?

   • AWait for the existing EDR rule that detects the trojan's signature to trigger an alert.
   • BBlock the cloud storage domain at the firewall and consider the hunt complete.
   • CSearch all endpoint logs for PowerShell execution events that include network connections to the specific cloud storage domain.
   • DRun a broad SIEM query for any process named powershell.exe that executed in the last 30 days.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A SOC team is hunting for an insider threat who is exfiltrating data via USB drives. The team has endpoint logs that record USB device insertion and file access events. However, the organization has a high volume of legitimate USB use. Which hunting approach would best identify the insider threat while minimizing false positives?

   • ACorrelate USB insertions with file access events that involve sensitive files and occur outside normal working hours.
   • BSearch for all USB insertions in the last 30 days and review each one manually.
   • CBlock all USB ports on all endpoints to prevent exfiltration.
   • DSearch for the specific USB device serial numbers from a known insider threat case.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of a hypothesis in hypothesis-driven threat hunting?

   • ATo automatically block all suspicious traffic identified during the hunt
   • BTo guide the search for specific adversary behaviors or techniques that may be present in the environment
   • CTo replace the need for threat intelligence during the hunt
   • DTo provide a formal justification for increasing the security budget
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A threat intelligence report provides a list of IOCs, including a domain, an IP, and a file hash. The SOC wants to hunt for these IOCs, but the log retention policy only keeps DNS logs for 7 days, proxy logs for 30 days, and EDR telemetry for 90 days. The hunt must cover the longest possible timeframe. Which approach is most effective?

   • ASearch only DNS logs for the domain and IP, covering 7 days.
   • BSearch only EDR telemetry for all three IOCs, covering 90 days.
   • CSearch proxy logs for all three IOCs, covering 30 days.
   • DSearch EDR telemetry for the file hash and the IP, and search proxy logs for the domain, covering up to 90 days for the hash and IP and 30 days for the domain.
   Reveal Solution Discussion Select an answer first