Threat Hunting and Detection CTIA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A threat hunter at a financial institution is investigating a hypothesis that attackers are using PowerShell to download and execute payloads from pastebin.com. The hunter has collected process creation logs, network connections, and script block logging from endpoints. After analyzing the data, the hunter finds several instances of powershell.exe making outbound connections to pastebin.com, but no evidence of file writes or persistence mechanisms. What should the hunter do NEXT in the threat hunting process?

   • ACreate a detection rule for any powershell.exe connection to pastebin.com and move on to the next hypothesis.
   • BClose the hunt as a false positive because no persistence mechanism was found.
   • CImmediately isolate all affected endpoints and report the findings to incident response.
   • DExpand the search to include process command-line arguments and script block content to determine if the downloaded content was executed.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A threat hunting team must decide between two methodologies for a hunt: (1) analytics-driven hunting using a new user and entity behavior analytics (UEBA) tool, or (2) hypothesis-driven hunting based on a recent industry report about a specific threat group. The team has limited time and must produce actionable findings. Which approach is more likely to yield actionable results quickly?

   • ANeither; the team should wait for a confirmed compromise before hunting
   • BA combination of both, but only if the UEBA tool is fully integrated with the SIEM
   • CAnalytics-driven hunting, because it automatically identifies all anomalies without manual effort
   • DHypothesis-driven hunting, because it focuses on known adversary behavior and can be validated with targeted data collection
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A detection engineer is creating a rule to detect credential dumping via LSASS access. The rule must have a low false positive rate because the environment has many legitimate applications that access LSASS. Which approach is most effective?

   • AAlert when LSASS is accessed by any process running as SYSTEM
   • BAlert on any process opening a handle to LSASS
   • CAlert when the LSASS process crashes
   • DAlert only when the process is not on an approved application whitelist and the access level includes PROCESS_VM_READ
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A threat hunter is investigating a potential data exfiltration. The hunter has a hypothesis that a specific user account is sending large amounts of data to an external cloud storage service. Which sequence of actions best follows the threat hunting process?

   • AForm a hypothesis, collect relevant logs (e.g., proxy, firewall, and DLP), analyze the data, and validate the findings
   • BCollect all network logs, analyze them for large outbound transfers, and then determine if the user account is involved
   • CSearch threat intelligence feeds for the cloud storage service and, if not listed, close the investigation
   • DImmediately disable the user account and then review logs
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is deciding between two threat hunting methodologies: IOC-based and analytics-driven. They have a mature SIEM with a large amount of historical data and a threat intelligence platform that provides a steady stream of IOCs. However, they have limited staff and cannot manually review every alert. Which methodology should they choose to maximize detection of unknown threats while managing analyst workload?

   • AManual hypothesis-driven hunting, because it is the most thorough.
   • BIOC-based hunting, because it is easier to automate and requires less manual analysis.
   • CA combination of both, but prioritize IOC-based hunting for immediate wins.
   • DAnalytics-driven hunting, because it can identify anomalies that may indicate unknown threats, and can be automated to reduce manual workload.
   Reveal Solution Discussion Select an answer first