Threat Hunting CSA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC manager wants to justify the value of threat hunting to leadership. Which statement best describes how threat hunting differs from traditional security monitoring?

   • AThreat hunting replaces traditional monitoring and makes SIEM alerts unnecessary.
   • BThreat hunting is only performed after a confirmed breach, while monitoring is continuous.
   • CThreat hunting proactively searches for unknown threats and behaviors, while monitoring relies on alerts from known signatures and rules.
   • DThreat hunting focuses on known IOCs, while monitoring focuses on unknown TTPs.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a threat hunt, an analyst observes a sequence of events on a single workstation: a PowerShell process spawning from an Office application, followed by a scheduled task creation, and then an outbound connection to an unusual IP. The analyst has not yet identified any known malware signatures. How should the analyst interpret this finding?

   • ATreat it as a potential indicator of attack (IOA) because the sequence of behaviors matches common adversary TTPs, and escalate for further investigation.
   • BSearch the SIEM for the specific IP address across all logs and close the hunt if no other host contacted it.
   • CIgnore it because no known IOC was matched and the activity could be legitimate administrative work.
   • DImmediately quarantine the workstation and wipe the disk to prevent any possible spread.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A SOC is hunting for a suspected APT that is known to use DLL sideloading and scheduled tasks for persistence. The team has access to Sysmon, PowerShell logs, and EDR telemetry, but limited time. The hunt must cover both execution and persistence. Which approach best balances coverage and efficiency?

   • AQuery EDR for all processes that loaded any DLL in the past week.
   • BFocus only on PowerShell logs for encoded commands, since APTs often use PowerShell.
   • CSearch for Sysmon events showing a known vulnerable process loading a DLL from a user-writable path, and correlate with scheduled task creation events.
   • DSearch for all scheduled task creation events in the past 90 days and review each one manually.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC team is planning a hunt for possible data exfiltration by an insider threat. The hunt must cover both network-level and endpoint-level activity. Which combination of data sources would provide the most comprehensive visibility for this hunt?

   • AAuthentication logs and VPN logs only.
   • BOnly firewall logs and NetFlow data.
   • CProxy logs, DNS logs, and EDR telemetry from endpoints.
   • DOnly Windows Event Logs and Sysmon logs.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is the best source for developing a hypothesis for a threat hunt?

   • AThe personal opinion of a junior analyst without any supporting data
   • BThe default configuration of the SIEM tool
   • CA random selection of log files from the past year
   • DThreat intelligence reports describing recent adversary tactics and techniques
   Reveal Solution Discussion Select an answer first