Threat Hunting and Detection CTIA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is new to threat hunting and wants to understand how it differs from traditional security monitoring. Which statement best describes the core difference?

   • AThreat hunting proactively searches for threats that may evade existing detection controls
   • BThreat hunting is a reactive process that starts after an alert is triggered
   • CThreat hunting is only performed after a security incident has occurred
   • DThreat hunting relies solely on automated tools to generate alerts
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat hunter is planning a hunt for credential dumping on Windows systems. The hunter has access to Sysmon logs, Windows Security logs, and network logs. The hunter wants to use a combination of data sources to detect both local and remote credential dumping. Which data source combination would be MOST effective?

   • AWindows Security logs for logon events (Event ID 4624) only.
   • BSysmon logs for process access (Event ID 10) and network logs for SMB connections.
   • CNetwork logs only, to detect remote credential dumping attempts.
   • DThreat intelligence feeds for known credential dumping tool hashes.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A small security team needs to start a threat hunting program but has limited budget and no dedicated hunting platform. They have access to Windows Event Logs, Sysmon, and a SIEM with basic query capabilities. They want to hunt for lateral movement using pass-the-hash techniques. Which tool or approach would be MOST practical for this team?

   • AManually review all Windows security logs from every server on a weekly basis.
   • BDeploy a full-fledged EDR platform with built-in hunting features.
   • CInstall a standalone network intrusion detection system (NIDS) to monitor SMB traffic.
   • DUse the SIEM to query for anomalous logon events (Event ID 4624) with NTLM authentication and correlate with network logs for SMB connections.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A threat hunter is looking for signs of data exfiltration in a corporate network. The hunter has access to NetFlow data, proxy logs, and endpoint DLP alerts. Which combination of techniques would be MOST effective in identifying potential exfiltration?

   • AManually review proxy logs for large file uploads to cloud storage services.
   • BDeploy a new network tap to capture all traffic for forensic analysis.
   • CFocus only on DLP alerts and ignore network data.
   • DUse automated hunting to correlate NetFlow data showing large outbound transfers with proxy logs and DLP alerts.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst at a mid-sized company is tasked with detecting a newly discovered malware family that uses a unique domain generation algorithm (DGA) and communicates over HTTPS with domains registered only hours before use. The analyst has access to DNS logs, proxy logs, and endpoint EDR telemetry. Which approach would be MOST effective for detecting this threat in the environment?

   • ASearch DNS logs for high-frequency queries to newly registered domains and correlate with EDR alerts for processes making those queries.
   • BBlock all HTTPS traffic to external domains to prevent the malware from communicating.
   • CCreate a YARA rule matching the malware's known file hashes and deploy it to all endpoints.
   • DRely solely on threat intelligence feeds for indicators of compromise and match them against proxy logs.
   Reveal Solution Discussion Select an answer first