Threat Hunting and Detection CTIA Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is a key advantage of hypothesis-driven threat hunting over IOC-based hunting?

   • AIt is fully automated and requires no analyst involvement
   • BIt can detect unknown or novel threats that lack known IOCs
   • CIt is faster and cheaper than any other method
   • DIt requires no prior knowledge of the environment
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security team has developed a new detection rule for a specific malware family. During validation, they find that the rule has a high true positive rate but also a high false positive rate. The team is concerned about alert fatigue but does not want to miss any real infections. They have a limited number of analysts. Which strategy would BEST balance the need to detect the malware while minimizing false positives?

   • ADeploy the rule as a high-fidelity alert that pages the on-call analyst immediately.
   • BDo not deploy the rule and rely on manual hunting to detect the malware.
   • CDeploy the rule as a low-priority alert that is only reviewed weekly.
   • DDeploy the rule with a suppression window for known benign processes and require additional context (e.g., parent process, file hash) to trigger an alert.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security operations center (SOC) is investigating a potential lateral movement attack. They need to identify which internal hosts communicated with a known malicious IP address over the past 48 hours. Which combination of data sources would provide the most complete evidence?

   • ANetFlow data and endpoint process creation logs
   • BFirewall logs and Active Directory authentication logs
   • CDNS logs and web proxy logs
   • DThreat intelligence feeds and vulnerability scan reports
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the primary purpose of threat hunting in a cybersecurity defense program?

   • ATo replace all automated security monitoring with manual analysis
   • BTo ensure compliance with regulatory requirements by generating audit logs
   • CTo reactively respond to alerts generated by existing security tools
   • DTo proactively search for hidden threats that evade existing security controls
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A threat hunter is working on a hypothesis that an attacker is using scheduled tasks to maintain persistence on Windows servers. The hunter has collected data from multiple sources, including Windows Event Logs, Sysmon, and threat intelligence feeds. After analyzing the data, the hunter finds several scheduled tasks that were created recently, but none of them match known malicious indicators. What should the hunter do NEXT?

   • AConclude that the hypothesis is false and move on to the next hunt.
   • BCompare the scheduled tasks against a baseline of known legitimate tasks and investigate any that are new or unusual.
   • CDelete the scheduled tasks to prevent potential persistence.
   • DImmediately report the scheduled tasks to incident response as confirmed malicious.
   Reveal Solution Discussion Select an answer first