Threat Hunting and Detection CTIA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key feature of Endpoint Detection and Response (EDR) tools that supports threat hunting?

   • AThey only provide static file analysis
   • BThey block all network traffic by default
   • CThey provide real-time visibility into endpoint processes and activities
   • DThey replace the need for threat intelligence feeds
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A threat hunting team is evaluating whether to use a commercial threat hunting platform that automates data collection and correlation, or to rely on manual hunting with open-source tools. The team has experienced analysts but limited budget. The organization faces a sophisticated adversary that uses fileless malware. What is the most important consideration in this decision?

   • AThe integration of the platform with existing SIEM and EDR tools
   • BThe commercial platform's ability to automate memory analysis and detect fileless indicators
   • CThe analysts' familiarity with open-source tools and their ability to manually hunt for fileless malware
   • DThe total cost of ownership, including training, maintenance, and the opportunity cost of analyst time
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization is hunting for a threat that is known to use encrypted communication channels and to persist via scheduled tasks. The team has access to firewall logs, EDR telemetry, and DNS logs. Which data source combination is most critical for detecting this threat?

   • AFirewall logs and DNS logs, because they show the encrypted connections and domain resolutions
   • BOnly EDR telemetry, because it can capture both network connections and scheduled tasks
   • CFirewall logs and EDR telemetry, because they cover network and endpoint, but DNS is not needed
   • DEDR telemetry and DNS logs, because EDR can show scheduled task creation and DNS shows the C2 domains
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key benefit of sharing threat hunting findings with the incident response team?

   • AIt reduces the need for incident response procedures
   • BIt provides context that helps prioritize and scope the response
   • CIt allows the incident response team to ignore other alerts
   • DIt guarantees that all future attacks will be prevented
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of detection engineering?

   • ATo patch vulnerabilities in software
   • BTo block all inbound network traffic
   • CTo design and implement rules that identify malicious activity
   • DTo encrypt data at rest and in transit
   Reveal Solution Discussion Select an answer first