Threat Hunting and Detection CTIA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small security team has limited staff and needs to continuously monitor for known indicators of compromise across thousands of endpoints. They also want to reduce alert fatigue. Which approach best balances automation and human oversight?

   • AMachine-assisted hunting using automated IOC scanning with analyst review of alerts
   • BFully automated hunting that automatically blocks any endpoint matching an IOC
   • CDeploying a SIEM and only relying on its default correlation rules
   • DManual hunting by the team reviewing every endpoint daily
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company wants to establish a sustainable threat hunting program. They have a small security team and limited budget. Which element is most important to include in the program's initial design?

   • ARequiring all hunting to be fully automated to save staff time
   • BA formal process for selecting hunting hypotheses and measuring outcomes
   • CA dedicated threat hunting team that works in isolation from the SOC
   • DPurchasing the most expensive commercial hunting platform
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary difference between manual and automated threat hunting?

   • AManual hunting is always more accurate than automated hunting
   • BManual hunting uses only open-source tools, while automated hunting uses commercial tools
   • CAutomated hunting does not require any human oversight
   • DManual hunting relies on human intuition and expertise, while automated hunting uses predefined rules and algorithms
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of a detection rule?

   • AA password policy requiring 12 characters
   • BA SIEM query that alerts on multiple failed logins followed by success
   • CA backup schedule that runs nightly
   • DA firewall rule that blocks port 22
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is establishing a threat hunting program and wants to measure its effectiveness. They have defined metrics such as number of hunts completed, time to detect, and number of findings validated. However, they are struggling to show the business value of the program to executives. Which metric or approach would BEST demonstrate the value of threat hunting?

   • AMeasure the reduction in mean time to respond (MTTR) to incidents that were discovered through hunting.
   • BReport the number of hunts completed and the number of IOCs discovered.
   • CTrack the number of false positives generated by hunting activities.
   • DCalculate the total number of hours spent on hunting activities.
   Reveal Solution Discussion Select an answer first