Overview and Importance of Threat Hunting TIE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A threat hunter is starting a new engagement. The hunter has reviewed the latest threat intelligence and identified a new malware family that uses unusual DNS queries. The hunter wants to search the environment for signs of this malware. Which step should the hunter take first in the hunting process?

   • ACollect all DNS logs from the past year and store them in a central repository.
   • BNotify the incident response team to be on standby for a potential infection.
   • CFormulate a hypothesis that the organization may have hosts making similar unusual DNS queries.
   • DBlock all DNS queries that match the malware's known domains.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial services company has experienced several security incidents where attackers remained undetected in the network for months. The CISO wants to implement a program that reduces the time between initial compromise and detection. Which initiative would most directly achieve this goal?

   • APurchase additional endpoint detection and response (EDR) licenses to cover all endpoints.
   • BImplement a threat hunting team that proactively searches for signs of compromise using threat intelligence and behavioral analytics.
   • CIncrease the frequency of full-disk backups to ensure data can be restored after an incident.
   • DDeploy a next-generation firewall with application-level filtering.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A threat hunter has completed the investigation phase of a hunting engagement and has confirmed that a particular host is compromised. According to the general threat hunting process, what should the hunter do next?

   • ARestart the host to clear any malicious processes from memory.
   • BImmediately disconnect the host from the network without notifying anyone.
   • CDelete the compromised host's logs to prevent the attacker from covering tracks.
   • DDocument the findings and hand over the incident to the incident response team for containment and eradication.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is debating whether to invest in threat hunting or continue relying solely on their existing detection tools. The team lead wants to highlight the unique value of threat hunting. Which statement best captures that unique value?

   • AThreat hunting can automate the entire detection process, eliminating the need for human analysts.
   • BThreat hunting can replace the need for a SIEM and all other security monitoring tools.
   • CThreat hunting can guarantee that no attacker will ever remain undetected in the environment.
   • DThreat hunting can detect unknown threats that do not match any existing signature or rule.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is reviewing the SOC's workflow. The current process relies on alerts from the SIEM and responds only when a rule triggers. The analyst wants to introduce a practice that actively searches for threats that may not trigger any alert. Which action best represents this shift?

   • ACreate a runbook for responding to a known malware family.
   • BConduct a threat hunting exercise based on a hypothesis about a new attack technique.
   • CTune the SIEM rules to reduce false positives.
   • DIncrease the log retention period to one year.
   Reveal Solution Discussion Select an answer first