Threat Hunting Techniques and Methodologies SCE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What makes a hypothesis testable in a threat hunting context?

   • AIt is approved by the SOC manager before the hunt begins
   • BIt is based on a known vulnerability in a specific software version
   • CIt aligns with the organization's compliance requirements
   • DIt can be proven or disproven by analyzing available data
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which threat hunting methodology relies on known indicators of compromise (IOCs) such as malicious file hashes or known command-and-control domains?

   • AIOC-based hunting
   • BAnalytics-driven hunting
   • CBaselining hunting
   • DHypothesis-driven hunting
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When reporting threat hunting findings to non-technical stakeholders, what is the most effective approach?

   • AUse as many technical acronyms as possible to demonstrate expertise
   • BSummarize the business impact, risk level, and recommended actions in plain language
   • CProvide a detailed list of all raw log entries and technical indicators
   • DOnly report if a critical threat is confirmed; otherwise, stay silent
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A SOC team has a mature SIEM but limited budget for new tools. They want to automate threat hunting workflows, including data collection, analysis, and reporting. Which approach is most cost-effective and practical?

   • AHire additional analysts to manually perform hunts.
   • BUse the SIEM's built-in scheduled queries, custom dashboards, and report generation features.
   • CPurchase a commercial threat hunting platform with full automation.
   • DExport logs to spreadsheets and use macros for analysis.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC manager wants to run a threat hunt for a newly discovered vulnerability in a legacy application. The hunt must be completed within one week, and the team has limited access to endpoint logs but full access to network flow data. The manager wants to minimize disruption to operations. Which plan best balances these constraints?

   • ATake the legacy application offline for a full forensic analysis.
   • BDeploy new endpoint agents to all systems to collect detailed logs.
   • CUse network flow data to look for anomalous connections to the application's ports and correlate with known exploit patterns.
   • DWait for the vendor to release a patch before hunting.
   Reveal Solution Discussion Select an answer first