Overview and Importance of Threat Hunting TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A healthcare organization has a mature security program with strong prevention controls, but recent penetration tests show that advanced attackers can still evade detection. The board asks for a strategy to improve the organization's security posture by focusing on detecting threats that bypass current controls. Which strategy aligns best with this objective?

   • AUpgrade all endpoints to the latest operating system version.
   • BIncrease the frequency of penetration tests to once a month.
   • CInvest in a threat hunting program that uses threat intelligence to proactively search for indicators of compromise.
   • DImplement a stricter password policy and enforce multi-factor authentication.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is explaining threat hunting to a colleague who is new to the concept. The colleague asks, 'How is threat hunting different from just checking the SIEM dashboard for alerts?' Which response is most accurate?

   • AThreat hunting involves actively searching for threats that may not have triggered any alerts, while checking the dashboard is waiting for alerts to appear.
   • BThreat hunting uses the same data as the SIEM but requires more expensive tools, so it is only for large enterprises.
   • CThreat hunting is a one-time project, while checking the dashboard is an ongoing daily activity.
   • DThreat hunting is only performed after a breach is confirmed, while checking the dashboard is done continuously.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat hunter is planning a new engagement. The hunter has reviewed recent threat intelligence and noticed an increase in attacks using a specific PowerShell technique. The hunter wants to search the environment for evidence of this technique. According to the general threat hunting process, what should the hunter do first?

   • ADevelop a hypothesis that the organization may be targeted with this PowerShell technique and define what evidence would confirm it.
   • BCollect all endpoint logs from the past year and store them in a data lake for future analysis.
   • CNotify the incident response team to prepare for a potential breach.
   • DImmediately block PowerShell execution across all endpoints to prevent the technique from succeeding.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement best defines threat hunting in a cybersecurity context?

   • AA forensic process applied only after a confirmed breach to determine the extent of damage.
   • BA compliance requirement that mandates periodic vulnerability scans of all external-facing systems.
   • CA proactive practice that actively searches for signs of threats that may have evaded existing defenses.
   • DA reactive process that waits for alerts from automated security tools before investigating.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best contrasts threat hunting with incident response?

   • AThreat hunting focuses on patching vulnerabilities, while incident response focuses on monitoring logs.
   • BThreat hunting is performed by automated tools, while incident response requires human analysts.
   • CThreat hunting occurs after a confirmed incident, while incident response is proactive.
   • DThreat hunting is proactive and seeks to find threats before they cause damage, while incident response is reactive and handles confirmed incidents.
   Reveal Solution Discussion Select an answer first