Threat Hunting Techniques and Methodologies SCE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the first step in a typical threat hunting engagement?

   • AAnalyzing the collected data for anomalies
   • BCollecting data from various sources
   • CReporting findings to stakeholders
   • DPlanning and defining the scope of the hunt
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A small SOC team has limited staffing and needs to hunt for signs of credential dumping across thousands of endpoints. They have a SIEM that ingests Windows Security logs and a threat intelligence feed that provides indicators of compromise (IOCs). Which approach best balances efficiency and coverage?

   • AWait for the threat intelligence feed to provide a new IOC and then search for that specific indicator.
   • BManually review Security logs from each endpoint for suspicious process activity.
   • CDeploy an EDR agent on a sample of endpoints and review alerts from those systems.
   • DCreate automated SIEM queries that match the IOCs from the threat feed and also look for common credential-dumping process names and command-line patterns.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which data source would provide the most detailed information about processes running on an endpoint?

   • AAuthentication logs
   • BNetFlow data
   • CEndpoint detection and response (EDR) telemetry
   • DFirewall logs
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC team is planning a hunt for a sophisticated adversary that is known to use living-off-the-land binaries (LOLBins) and to operate primarily during off-hours. The team has access to endpoint logs, but network logs are only available for a limited retention period. Which data collection strategy is most effective?

   • ACollect only network logs for off-hours, since the adversary is known to operate then.
   • BCollect endpoint logs and network logs for all hours, prioritizing the collection of endpoint logs due to the use of LOLBins.
   • CCollect only endpoint logs for off-hours, since the adversary operates then.
   • DCollect endpoint logs for all hours and network logs only for off-hours, since the adversary operates then.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which tool category is specifically designed to query and analyze large volumes of security data for threat hunting?

   • AVulnerability scanner
   • BPatch management tool
   • CSecurity information and event management (SIEM)
   • DNetwork mapping tool
   Reveal Solution Discussion Select an answer first