Threat Hunting Techniques and Methodologies SCE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC team is planning a hunt for a threat actor that is known to use both commodity malware and custom tools. The team has a limited time window and must decide between an IOC-based hunt and a hypothesis-driven hunt. Which approach is more likely to uncover the custom tools?

   • ABaselining, because it establishes a normal baseline and flags any deviation.
   • BAnalytics-driven hunting, because it uses machine learning to detect any anomaly.
   • CHypothesis-driven hunting, because it focuses on behavior and can detect custom tools even without known indicators.
   • DIOC-based hunting, because it can quickly identify known malware families.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A hunt identifies a series of failed logon attempts followed by a successful logon from a foreign IP address. The user is a remote worker who frequently travels. The analyst must decide whether this is a true positive or a false positive. Which combination of factors would most strongly support a true positive?

   • AThe user's device is a company-managed laptop with full disk encryption.
   • BThe successful logon occurred at a time consistent with the user's normal working hours.
   • CThe failed logon attempts occurred over a short period, and the user is known to travel frequently.
   • DThe user's account has never logged in from that IP address before, and the successful logon was followed by access to sensitive files.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a hunt, an analyst identifies a series of PowerShell commands that download and execute a script from a remote server. The script is not flagged by antivirus, and the remote server is a known file-sharing site. What is the most appropriate next step?

   • ATreat it as a false positive because the file-sharing site is legitimate and antivirus did not flag it.
   • BTreat it as a true positive and immediately isolate the host.
   • CAnalyze the script in a sandbox and review the host's historical activity to determine if the execution is consistent with the user's role and baseline.
   • DDocument the finding as inconclusive and move on to the next hunt.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is hunting for command-and-control (C2) activity in an environment where most hosts use dynamic DNS and cloud-based services. The analyst has DNS logs and proxy logs. Which technique would best reduce false positives while identifying potential C2?

   • AFlag any connection to a domain that is not on an allowlist.
   • BBaseline each host's DNS and proxy behavior, then flag deviations such as new domains or unusual connection patterns.
   • CSearch for domains with a short time-to-live (TTL) value.
   • DBlock all traffic to unknown domains.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A threat hunter is investigating a possible data breach that occurred two months ago. The organization only retains endpoint logs for 30 days, but network flow data is retained for one year. The hunter needs to determine if a specific workstation was compromised. Which approach is most feasible?

   • AConclude that no compromise occurred because endpoint logs are unavailable.
   • BUse network flow data to identify connections from the workstation to suspicious external IPs during the breach period.
   • CInterview the user of the workstation to recall any suspicious activity.
   • DAttempt to recover deleted endpoint logs from backups.
   Reveal Solution Discussion Select an answer first