Threat Hunting and Detection CTIA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a threat hunting session, an analyst discovers a malicious PowerShell script on a server that is not yet flagged by existing security tools. The script appears to be part of a larger campaign. What is the most appropriate immediate action?

   • AQuarantine the server and wait for the next scheduled maintenance window
   • BAdd the script hash to the blocklist and continue hunting
   • CDelete the script and move on to the next hunting task
   • DDocument the finding and escalate it to the incident response team with all relevant evidence
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a key component of a sustainable threat hunting program?

   • ADefined roles and responsibilities for hunters
   • BEliminating all manual processes
   • CKeeping hunting activities undocumented
   • DA one-time investment in hunting tools
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a threat hunting exercise, a hunter discovers a previously unknown backdoor on a server that is not currently communicating with any external host. The hunter has documented the evidence and wants to ensure the finding leads to remediation. What is the MOST appropriate next step?

   • AMonitor the backdoor for 30 days to see if it becomes active before reporting.
   • BReport the finding to the incident response team with all relevant evidence and recommend containment actions.
   • CAdd a detection rule for the backdoor's hash and continue hunting.
   • DImmediately delete the backdoor file and move on to the next hunt.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A detection engineer is writing a Sigma rule to detect suspicious use of the Windows built-in tool certutil.exe to download files. The engineer wants to minimize false positives while still catching malicious usage. Which rule logic would be BEST?

   • AAlert on certutil.exe with '-urlcache' and '-split' flags when the process parent is not a standard system process or when the command line contains a non-internal URL.
   • BAlert on any execution of certutil.exe with the '-urlcache' and '-split' flags.
   • CAlert only when certutil.exe downloads a file with a .exe extension.
   • DAlert on any execution of certutil.exe regardless of flags.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A threat hunter is investigating a potential insider threat who may be using a personal USB drive to copy sensitive files. The hunter needs to determine which data sources would provide the most relevant evidence. Which data source should the hunter prioritize?

   • ADNS logs to check for unusual domain queries.
   • BWindows Event Logs for USB device installation events (Event ID 20001/20003) and file access logs.
   • CThreat intelligence feeds for known malicious USB device serial numbers.
   • DFirewall logs to see if the user is sending data over the network.
   Reveal Solution Discussion Select an answer first