Leveraging Threat Intelligence for Hunting SCE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A threat hunter finds a suspicious domain in DNS logs that matches an IOC from a commercial feed. Before escalating, the hunter wants to enrich the finding with additional context. Which action provides the most useful enrichment?

   • ASearch the domain in the organization's web proxy logs
   • BQuery the domain's WHOIS records and passive DNS history
   • CAdd the domain to the SIEM as a watchlist item
   • DCheck if the domain is accessible from the hunter's workstation
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SOC team is investigating a series of alerts that all involve the same file hash, which is flagged by a commercial threat intelligence feed. However, the hash is not associated with any known TTPs in the feed. The team has limited time and must decide whether to hunt for the hash across all endpoints or focus on behavioral patterns. The team's goal is to detect the threat even if the hash changes. Which approach should they take?

   • AHunt only for behavioral patterns such as unusual process execution
   • BHunt for the file hash across all endpoints and also look for related behavioral patterns such as unusual process execution
   • CIgnore the hash and wait for the feed to provide TTPs
   • DHunt only for the file hash across all endpoints
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat hunter reads a report about a new ransomware group that uses legitimate Windows administrative tools (LOLBins) to evade detection. The hunter wants to proactively search the environment for signs of this activity before any alerts fire. Which action best aligns with hypothesis-driven hunting?

   • ASearch for the specific ransomware file hashes from the report
   • BWait for the SIEM to generate an alert based on known IOCs
   • CFormulate a hypothesis that the group may be using tools like PowerShell or WMI for execution, and hunt for those patterns
   • DBlock all LOLBins in the environment
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a common method for integrating threat intelligence into a SIEM platform?

   • AManually reviewing threat reports and applying them to firewall rules
   • BReplacing the SIEM with a threat intelligence platform
   • CUsing threat intelligence only during incident response
   • DImporting IOCs into a threat intelligence feed that the SIEM can query
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is an example of a hypothesis that could be used in threat hunting?

   • A'The SIEM is generating too many alerts.'
   • B'The attacker may be using a specific file hash to evade detection.'
   • C'The firewall needs to be updated.'
   • D'The network is slow today.'
   Reveal Solution Discussion Select an answer first