Overview and Importance of Threat Hunting TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security operations team is debating how to allocate its limited budget. The team currently has a robust incident response plan and a SIEM that generates alerts based on known indicators. The organization has experienced several incidents where attackers used custom malware that evaded the SIEM. The team must choose between (1) enhancing the SIEM with more threat intelligence feeds and (2) training analysts to conduct threat hunting. The CISO wants the approach that will most effectively reduce the impact of future unknown threats. Which approach should the team choose?

   • AIncrease the frequency of penetration tests to identify vulnerabilities that custom malware might exploit.
   • BPurchase a more expensive SIEM platform with built-in machine learning.
   • CEnhance the SIEM with additional threat intelligence feeds to improve alert correlation.
   • DTrain analysts in threat hunting techniques to proactively search for anomalies and unknown threats.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team has implemented a threat hunting program and has been running hunts for six months. The team has identified several instances of malware that were not detected by existing controls. However, management is questioning the value of the program because the number of incidents has not decreased. Which response best explains the value of the program?

   • AThe program should be discontinued because it is not reducing the number of incidents.
   • BThe program should focus on preventing incidents rather than detecting them.
   • CThe program is not effective because the number of incidents has not decreased.
   • DThe program has improved detection capabilities, which may increase the number of reported incidents in the short term, but it reduces dwell time and overall risk.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security operations center (SOC) is overwhelmed by a high volume of alerts, many of which are false positives. The SOC manager wants to introduce threat hunting but is concerned that it will add to the analysts' workload. The manager needs to justify the investment to the CISO. Which argument best addresses the manager's concern while highlighting the value of hunting?

   • AThreat hunting will increase the workload initially, but the insights gained will improve detection rules and reduce future false positives, ultimately saving time.
   • BThreat hunting can be fully automated with machine learning, so it will not require any additional analyst time.
   • CThreat hunting will replace the need for the SIEM, so the team can focus entirely on hunting and ignore alerts.
   • DThreat hunting will reduce the number of alerts by tuning the SIEM rules, freeing up analyst time for hunting.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A threat hunter is investigating a potential compromise. The hunter has developed a hypothesis that an attacker is using a specific command-line tool to enumerate Active Directory. The hunter searches the logs and finds several instances of the tool being used, but some are from legitimate administrative activity. The hunter must decide how to proceed. Which action is most appropriate?

   • ACorrelate the instances with other indicators, such as time of day, source IP, and associated processes, to distinguish malicious from legitimate activity.
   • BTreat all instances as malicious and escalate to incident response.
   • CImmediately block the tool from running on all systems.
   • DIgnore the findings because the tool is commonly used by administrators.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's management is evaluating whether to invest in a threat hunting program. They want to understand the tangible benefits beyond just 'improving security'. Which benefit is most directly associated with a mature threat hunting program?

   • AIt reduces the mean time to detect (MTTD) by actively identifying threats that evade automated controls.
   • BIt automatically patches all vulnerabilities in the environment.
   • CIt eliminates the need for traditional security controls such as firewalls and antivirus.
   • DIt guarantees that all future cyberattacks will be prevented.
   Reveal Solution Discussion Select an answer first