Forming Threat Hunting Hypotheses TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You are hunting for a threat actor that is known to use credential dumping (T1003) and lateral movement via SMB (T1021.002). You have a hypothesis that the actor is using these techniques on your Windows domain. Which MITRE ATT&CK tactic would you primarily associate with the credential dumping technique?

   • ADiscovery
   • BExfiltration
   • CLateral Movement
   • DCredential Access
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst notices an unusual pattern: several workstations are connecting to an internal file server at 3:00 AM, which is outside normal business hours. The analyst wants to start a threat hunt. Which approach best exemplifies hypothesis-driven hunting?

   • AWait for the activity to happen again and then manually inspect each connection.
   • BSearch for all network connections in the last 24 hours without any specific focus.
   • CFormulate a hypothesis that the connections are due to a scheduled backup or a compromised account, then look for evidence of either.
   • DImmediately block the file server's IP address to stop the activity.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How can threat intelligence reports be used to generate threat hunting hypotheses?

   • ABy automatically blocking all malicious traffic based on the report's recommendations
   • BBy identifying new vulnerabilities in the organization's software that need patching
   • CBy providing indicators of compromise (IOCs) and TTPs that can be used to formulate hypotheses about potential adversary activity
   • DBy providing a list of all known malware families to search for in the environment
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is it important to base threat hunting hypotheses on knowledge of the organization's environment?

   • ABecause it allows the hunter to skip the data collection phase and go straight to conclusions
   • BBecause it guarantees that the hypothesis will be correct and no further validation is needed
   • CBecause it is required by regulatory compliance standards for all threat hunting activities
   • DBecause it helps tailor the hypothesis to the specific assets, systems, and normal behaviors that are relevant to the organization
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the defining characteristic of hypothesis-driven threat hunting?

   • ARunning automated tools that scan all network traffic for any known malware signatures without prior assumptions
   • BWaiting for an alert from a SIEM and then investigating the alert to determine if it is a true positive
   • CReviewing historical log data after a breach to identify what went wrong and how the attacker gained access
   • DStarting with a specific, testable statement about potential adversary behavior and then searching for evidence to confirm or refute it
   Reveal Solution Discussion Select an answer first