A threat hunt uncovered several suspicious activities, but after validation, most were false positives. One finding was confirmed as a true positive. The SOC manager wants a report that supports decision-making. What should the report emphasize?

The hunting methodology used, without mentioning results.

The number of false positives to show the volume of work.

The confirmed true positive, its evidence, and recommended actions.

Only the true positive, omitting the false positives.

Which of the following is a valid source for generating a threat hunting hypothesis?

The organization's marketing strategy

The latest threat intelligence report on a new adversary group

A list of all employees' favorite websites

A random guess about potential attacker behavior

After completing a threat hunt that identified a previously unknown malware family on three workstations, a SOC analyst must report the findings to the IT manager, who is not a security expert. Which reporting approach is most effective?

Send the raw SIEM logs and threat intelligence reports to the manager for review.

Summarize the findings in plain language, explain the potential business impact, and recommend immediate containment steps.

Wait until the investigation is fully complete and all workstations are remediated before reporting anything.

Provide a detailed technical report with file hashes, process names, and network indicators for each affected workstation.

A SOC team is about to start a threat hunting engagement focused on detecting lateral movement. They have access to authentication logs, process creation logs, and network connection logs. Which sequence of steps best follows the threat hunting process?

Report the findings first, then collect data to support the report.

Generate a hypothesis, then collect relevant data, then analyze the data, then validate findings and report.

Analyze the data first, then generate a hypothesis based on what is found, then report.

Collect data, then generate a hypothesis, then analyze the data, then report findings.

An analyst is hunting for signs of a ransomware attack that encrypts files and deletes shadow copies. The analyst has access to file system logs, Windows Event logs, and endpoint detection and response (EDR) telemetry. Which hunting technique would be most effective?

Anomaly detection, to identify any deviation from normal endpoint behavior.

Pattern recognition, to search for known ransomware behaviors such as mass file renames, shadow copy deletion, and encryption-related process activity.

IOC-based hunting, using file hashes from known ransomware families.

Baselining, to compare current file activity to historical patterns.

EC-CouncilSOC Essentials

Domain 7Objective 4

Threat Hunting Techniques and Methodologies SCE Practice Questions (Page 6)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

9concepts

Questions 26–30

26expert · hard
A threat hunt uncovered several suspicious activities, but after validation, most were false positives. One finding was confirmed as a true positive. The SOC manager wants a report that supports decision-making. What should the report emphasize?
Select an answer first
27foundation · easy
Which of the following is a valid source for generating a threat hunting hypothesis?
Select an answer first
28application · medium
After completing a threat hunt that identified a previously unknown malware family on three workstations, a SOC analyst must report the findings to the IT manager, who is not a security expert. Which reporting approach is most effective?
Select an answer first
29application · medium
A SOC team is about to start a threat hunting engagement focused on detecting lateral movement. They have access to authentication logs, process creation logs, and network connection logs. Which sequence of steps best follows the threat hunting process?
Select an answer first
30application · medium
An analyst is hunting for signs of a ransomware attack that encrypts files and deletes shadow copies. The analyst has access to file system logs, Windows Event logs, and endpoint detection and response (EDR) telemetry. Which hunting technique would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.