What is the primary purpose of prioritizing multiple threat hunting hypotheses?

To focus limited hunting resources on the hypotheses that pose the greatest risk and are most likely to be true

To select the hypothesis that is easiest to test, regardless of its importance

To eliminate the need for further investigation by choosing the most popular hypothesis

To ensure that all hypotheses are tested in alphabetical order to avoid bias

A security team is implementing threat hunting for the first time. They have a SIEM with logs from firewalls, endpoints, and Active Directory. They want to start with a hypothesis-driven approach. Which initial step is most aligned with this approach?

Use an automated tool to identify all anomalies and then investigate each one.

Run a search for all events related to PowerShell execution in the last 30 days.

Review the MITRE ATT&CK framework and select a technique that is relevant to the organization's environment, then form a hypothesis about how that technique might be used.

Wait for a security alert to trigger and then investigate it.

What should be included when documenting a threat hunting hypothesis for communication to stakeholders?

Only the final conclusion of the hunt, without any supporting details

The exact commands used to search logs, but not the hypothesis itself

The names of all employees involved in the hunt, but no technical details

The hypothesis statement, the rationale, and the expected evidence that would confirm or refute it

A threat hunter has documented a hypothesis about potential data exfiltration via DNS tunneling. The hunter needs to communicate this to the SOC team. Which communication approach is most effective?

Send an email to the SOC manager with the hypothesis and ask them to investigate.

Wait until the hunt is complete and then present the findings.

Post the hypothesis in a chat channel with a brief description and ask for feedback.

Create a formal hunt plan that includes the hypothesis, rationale, expected evidence, and ATT&CK techniques, and present it in a team meeting.

What makes a threat hunting hypothesis 'testable'?

It is approved by the security team before the hunt begins

It is based on a well-known vulnerability that has a public CVE identifier

It can be proven true by finding at least one matching log entry

It defines specific evidence that would confirm or refute the hypothesis and can be sought in available data

EC-CouncilThreat Intelligence Essentials

Domain 7Objective 4

Forming Threat Hunting Hypotheses TIE Practice Questions (Page 1)

Part of the Threat Hunting and Detection domain, which makes up ~12% of our current practice bank.

31questions here

7free pages

7concepts

Questions 1–5

1foundation · easy
What is the primary purpose of prioritizing multiple threat hunting hypotheses?
Select an answer first
2expert · hard
A security team is implementing threat hunting for the first time. They have a SIEM with logs from firewalls, endpoints, and Active Directory. They want to start with a hypothesis-driven approach. Which initial step is most aligned with this approach?
Select an answer first
3foundation · easy
What should be included when documenting a threat hunting hypothesis for communication to stakeholders?
Select an answer first
4application · medium
A threat hunter has documented a hypothesis about potential data exfiltration via DNS tunneling. The hunter needs to communicate this to the SOC team. Which communication approach is most effective?
Select an answer first
5foundation · easy
What makes a threat hunting hypothesis 'testable'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.