Threat Hunting CSA Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   During the validation phase of a threat hunt, what is the primary action an analyst performs?

   • ADeleting false positive alerts from the monitoring system
   • BConfirming whether the collected evidence supports or refutes the hypothesis
   • CEscalating all findings to incident response immediately
   • DCreating new detection rules for the SIEM
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC analyst is hunting for command-and-control (C2) communication. The analyst suspects that a compromised host is using DNS tunneling to exfiltrate data. Which combination of tools and data would be most effective for this hunt?

   • APacket captures and manual analysis of all DNS traffic for a week.
   • BEndpoint process logs and a search for the presence of tunneling tools like dnscat2.
   • CDNS logs and a SIEM query to identify unusually long or frequent DNS queries to a single domain.
   • DFirewall logs and a search for connections to known malicious IPs.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A SOC team is hunting for ransomware that encrypts files and then deletes shadow copies. The team wants to detect this activity early, before widespread encryption occurs. Which hunting query would be most effective?

   • AMonitor for the combination of vssadmin.exe execution followed by mass file modifications (e.g., .encrypted extensions) on multiple hosts.
   • BLook for the presence of a known ransomware file hash on endpoints.
   • CSearch for any process that opens many files in a short period.
   • DCheck for the creation of a ransom note file on any system.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A SOC team is planning a hunt for a sophisticated adversary that uses legitimate cloud APIs for C2 and data exfiltration. The team has limited analyst time and must choose between two hypotheses: (1) the adversary uses a specific known cloud storage service for C2, or (2) the adversary uses multiple cloud services to blend in with normal traffic. Which approach is most effective given the constraint of limited analyst time?

   • ARun both hypotheses simultaneously using automated queries to cover all possibilities.
   • BSkip the hunt and rely on existing cloud provider security alerts.
   • CFocus on hypothesis (1) and search for anomalies in the specific service's API usage, such as unusual authentication patterns or data volumes.
   • DFocus on hypothesis (2) and build a baseline of all cloud API traffic to detect deviations.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is a valuable data source for threat hunting?

   • ABuilding access control lists
   • BNetwork flow logs
   • CMarketing campaign analytics
   • DEmployee vacation schedules
   Reveal Solution Discussion Select an answer first