What is the purpose of baselining in threat hunting?

To establish a pattern of normal behavior so that deviations can be identified

To create a list of known malicious IP addresses

To compare the organization's security posture against industry standards

To prioritize vulnerabilities based on risk

A SOC team is planning a hunt to detect data exfiltration by insiders. They have access to proxy logs, email logs, and endpoint file access logs. Which data collection strategy would provide the most comprehensive coverage?

Collect endpoint file access logs to identify access to sensitive files.

Collect only proxy logs to identify large outbound transfers.

Collect email logs only, since email is the most common exfiltration channel.

Collect proxy, email, and endpoint file access logs, and correlate them to identify sensitive files being sent outside the organization.

A SOC team has limited time and resources for a threat hunt. They have a list of IOCs from a recent threat intelligence report and also have a hypothesis about a new attack technique that is not yet associated with any IOCs. Which hunting approach should they prioritize?

Hypothesis-driven hunting, because it can detect unknown threats even without IOCs.

IOC-based hunting, because it is faster and more likely to produce immediate results.

Focus on analytics-driven hunting, using machine learning to detect any anomaly.

Run both approaches in parallel, allocating resources based on the likelihood of each threat and the available data.

How can automation enhance threat hunting efficiency?

By automatically triaging and correlating large volumes of data to surface potential leads

By replacing the need for human analysts entirely

By eliminating false positives completely

By generating final reports without human review

A SOC team wants to implement a continuous hunting program but has a limited budget. They have a SIEM with basic correlation capabilities and a small team of analysts. Which approach provides the best balance of automation and human expertise?

Deploy a commercial threat hunting platform that requires no analyst involvement.

Fully automate the hunting process using a SOAR platform to replace manual analysis.

Hire additional analysts to manually review all logs.

Use the SIEM to create automated queries for known patterns and have analysts review the results on a daily basis.

EC-CouncilSOC Essentials

Domain 7Objective 4

Threat Hunting Techniques and Methodologies SCE Practice Questions (Page 7)

Part of the Threat Intelligence and Hunting domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

9concepts

Questions 31–35

31foundation · easy
What is the purpose of baselining in threat hunting?
Select an answer first
32application · medium
A SOC team is planning a hunt to detect data exfiltration by insiders. They have access to proxy logs, email logs, and endpoint file access logs. Which data collection strategy would provide the most comprehensive coverage?
Select an answer first
33expert · hard
A SOC team has limited time and resources for a threat hunt. They have a list of IOCs from a recent threat intelligence report and also have a hypothesis about a new attack technique that is not yet associated with any IOCs. Which hunting approach should they prioritize?
Select an answer first
34foundation · easy
How can automation enhance threat hunting efficiency?
Select an answer first
35expert · hard
A SOC team wants to implement a continuous hunting program but has a limited budget. They have a SIEM with basic correlation capabilities and a small team of analysts. Which approach provides the best balance of automation and human expertise?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.