Threat Hunting Techniques and Methodologies SCE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which hunting technique is most effective for detecting a new malware variant that has never been seen before?

   • AReviewing firewall rules for misconfigurations
   • BSearching for known command-and-control domains
   • CAnomaly detection based on behavioral deviations
   • DSignature matching against known malware hashes
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC team wants to identify compromised endpoints that are beaconing to a known command-and-control (C2) domain. The team has access to firewall logs, DNS logs, and endpoint process creation logs. Which combination of data sources and hunting technique would be most effective?

   • AUse firewall logs to identify all outbound connections and block the C2 domain at the firewall.
   • BUse firewall logs to identify the source IP addresses that connected to the C2 domain, then reimage those endpoints.
   • CUse endpoint process creation logs alone to find any process that makes a network connection.
   • DUse DNS logs to identify repeated queries to the C2 domain and correlate with endpoint process creation logs to find the responsible process.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which step in the threat hunting process involves validating that a finding is a true positive and not a false alarm?

   • AData collection
   • BReporting
   • CAnalysis and validation
   • DHypothesis generation
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which data source is most likely to provide evidence of command-and-control (C2) communication from an infected endpoint?

   • ADNS logs
   • BPhysical access logs
   • CHR employee records
   • DMarketing analytics data
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC analyst at a mid-sized financial firm is planning a threat hunt after a public report describes a new banking trojan that uses PowerShell to download a second-stage payload from a rarely-used file-sharing domain. The analyst wants to search for signs of this activity in the environment. Which approach best aligns with a hypothesis-driven hunt?

   • AReview firewall logs for any connection to the file-sharing domain, regardless of source process.
   • BRun a full antivirus scan on all endpoints and quarantine any detected trojans.
   • CSearch for PowerShell processes that made network connections to the specific file-sharing domain in the reporting period.
   • DSearch all endpoints for any process that invoked PowerShell in the last 90 days.
   Reveal Solution Discussion Select an answer first