Overview and Importance of Threat Hunting TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A threat hunter is conducting an engagement and has found evidence of a potential compromise. The hunter has confirmed that the activity is malicious and is ongoing. According to the threat hunting process, what should the hunter do next?

   • AContain the threat by isolating the affected systems before informing anyone, to prevent further spread.
   • BDocument the findings and close the engagement, as the hunting phase is complete.
   • CImmediately escalate the findings to the incident response team and provide them with the evidence collected so far.
   • DContinue the hunt to gather more evidence before notifying anyone, to ensure the findings are complete.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is asked to describe the difference between threat hunting and incident response to a new team member. The analyst explains that threat hunting is proactive, while incident response is reactive. Which scenario best illustrates this difference?

   • AThe team receives an alert about a suspicious login and immediately investigates the account's activity.
   • BThe team updates the SIEM correlation rules after a malware outbreak to detect similar future infections.
   • CThe team waits for the annual penetration test report and then fixes the vulnerabilities that were found.
   • DThe team reviews threat intelligence and decides to search for a specific command-and-control pattern that has not yet triggered any alerts.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security manager is trying to justify a threat hunting program to the board. The manager needs to explain the benefits in terms that resonate with business risk. Which benefit should the manager emphasize as the most direct outcome of reducing dwell time?

   • AImmediate reduction in the number of security tools needed, lowering overall security costs.
   • BElimination of all false positives from the SIEM, allowing analysts to focus on real threats.
   • CGuaranteed prevention of all future cyberattacks against the organization.
   • DReduced likelihood of data exfiltration because threats are detected and contained earlier in the attack lifecycle.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is threat hunting important for improving an organization's security posture?

   • AIt guarantees that no breach will ever succeed against the organization.
   • BIt eliminates the need for continuous monitoring and log collection.
   • CIt reduces dwell time by detecting threats that automated tools may miss.
   • DIt automatically patches all vulnerabilities without human intervention.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the typical first step in a threat hunting engagement?

   • AIsolating affected systems to prevent further damage.
   • BFormulating a hypothesis about potential threat activity.
   • CDeploying new security tools to collect additional data.
   • DNotifying law enforcement of a suspected breach.
   Reveal Solution Discussion Select an answer first