Threat Hunting and Detection CTIA Practice Questions (Page 11)

Questions 51–52

1. 51expert · hard

   A threat hunter has identified a compromised host that is beaconing to a known command-and-control (C2) server. The hunter has confirmed the activity and has evidence. The incident response team is currently handling a separate, more critical incident and cannot immediately respond to this new finding. The hunter's manager wants to ensure the finding is not lost and that the host is eventually remediated. What should the hunter do?

   • AWait until the incident response team is available and then report the finding.
   • BDocument the finding in the threat hunting report and add the host to a watchlist for monitoring.
   • CDelete the evidence and continue hunting to avoid interfering with the ongoing incident.
   • DImmediately isolate the host from the network to prevent further C2 communication, then report the finding to the incident response team.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which threat hunting methodology relies on known indicators of compromise (IOCs) to search for threats?

   • AIOC-based hunting
   • BHypothesis-driven hunting
   • CAnalytics-driven hunting
   • DHybrid hunting
   Reveal Solution Discussion Select an answer first