Overview and Importance of Threat Hunting TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC manager is comparing two approaches: (1) waiting for the SIEM to generate an alert and then investigating, and (2) proactively searching for threats using hypotheses derived from threat intelligence. The manager wants to document the key difference between these approaches. Which statement accurately captures the difference?

   • AApproach 1 is proactive, while approach 2 is reactive.
   • BApproach 1 is more effective at detecting unknown threats.
   • CApproach 1 relies on automated detection, while approach 2 relies on human-driven investigation.
   • DApproach 2 is only used after a security incident has been confirmed.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security operations center (SOC) analyst notices that the organization's existing security controls have failed to detect a series of low-and-slow intrusion attempts that eventually led to a data breach. Management asks the analyst to recommend a proactive approach to reduce the likelihood of similar undetected intrusions in the future. Which approach best addresses this requirement?

   • AImplement a formal threat hunting program that develops hypotheses based on the latest threat intelligence and actively searches for indicators of compromise.
   • BDeploy additional intrusion detection system (IDS) signatures to match the observed attack patterns.
   • CIncrease the frequency of vulnerability scans across the network to identify missing patches.
   • DExpand the incident response team's after-hours availability to respond faster to future alerts.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is explaining threat hunting to a new team member. The analyst wants to emphasize that threat hunting is not just another term for incident response. Which statement best clarifies the distinction?

   • AThreat hunting is performed only after a security incident has been confirmed.
   • BThreat hunting is a fully automated process that requires no human involvement.
   • CThreat hunting focuses only on external threats, while incident response handles insider threats.
   • DThreat hunting proactively searches for threats, while incident response reacts to confirmed incidents.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a key benefit of implementing a threat hunting program?

   • AIt enhances detection capabilities by uncovering threats that evade automated tools.
   • BIt guarantees that all cyberattacks will be prevented.
   • CIt reduces the organization's attack surface by disabling unused services.
   • DIt eliminates the need for security monitoring tools.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A threat hunter at a mid-sized company is planning a new hunting engagement. The hunter has reviewed recent threat intelligence reports and noticed a new phishing campaign that delivers a previously unknown remote access trojan (RAT). The hunter wants to search the network for signs of this RAT. According to the general threat hunting process, what should the hunter do first?

   • AImmediately quarantine all endpoints that received phishing emails.
   • BWait for the SIEM to generate an alert before starting the investigation.
   • CDevelop a hypothesis about how the RAT might appear in network traffic and endpoint logs.
   • DDeploy a new signature for the RAT to the antivirus solution.
   Reveal Solution Discussion Select an answer first