Overview and Importance of Threat Hunting TIE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   How does threat hunting differ from traditional reactive security measures such as automated alerts?

   • AThreat hunting actively searches for threats, while reactive measures wait for alerts or incidents.
   • BThreat hunting relies solely on automated tools, while reactive measures require human analysis.
   • CThreat hunting is performed only after a breach, while reactive measures are performed continuously.
   • DThreat hunting is initiated by an alert, while reactive measures are proactive.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A mid-sized company has a mature SIEM with many correlation rules, but a post-incident review revealed that an attacker had maintained persistence for over six months without triggering any alerts. The CISO wants to improve the organization's ability to detect such stealthy threats. Which initiative would most directly address this weakness?

   • AIncrease the retention period for SIEM logs from 90 days to one year.
   • BDeploy additional signature-based intrusion detection systems at the network perimeter.
   • CEstablish a threat hunting team that develops hypotheses based on the attacker's tactics, techniques, and procedures (TTPs) and actively searches for similar activity.
   • DPurchase a threat intelligence feed and automatically block all indicators of compromise (IOCs) from the feed.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A large enterprise has a well-staffed SOC that uses a SIEM with hundreds of correlation rules. The SOC receives thousands of alerts daily, but the team spends most of its time triaging false positives. A recent breach went undetected for six months because the attacker used living-off-the-land binaries and encrypted traffic. The CISO wants to reduce dwell time and improve detection of such stealthy threats. The security team proposes two initiatives: (A) tuning the SIEM rules to reduce false positives, and (B) implementing a threat hunting program. The CISO asks for a recommendation that addresses the root cause of the missed detection. Which recommendation is most appropriate?

   • AFocus on tuning the SIEM rules to eliminate false positives, because the high alert volume is the root cause of the missed detection.
   • BImplement a threat hunting program that uses hypotheses based on threat intelligence to proactively search for living-off-the-land and encrypted traffic anomalies.
   • CIncrease the SIEM log retention period to two years to enable future forensic analysis.
   • DDeploy a network traffic analysis tool that focuses on encrypted traffic decryption.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has experienced several breaches where the attacker remained undetected for months. The security team wants to implement a program that will reduce the time to detection. Which combination of activities best supports this goal?

   • APurchase additional threat intelligence feeds and integrate them into the SIEM to generate more alerts.
   • BConduct regular threat hunting engagements using hypotheses based on the latest threat intelligence and investigate anomalies in endpoint and network data.
   • CHire more incident responders so that when an alert does fire, the team can respond faster.
   • DIncrease the frequency of vulnerability scans and patch management cycles.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security manager is evaluating the effectiveness of a new threat hunting program. The program has been running for six months, but the number of detected incidents has not increased. The manager is considering canceling the program. Which consideration should the manager take into account before making a decision?

   • AThe program should be expanded because the lack of incidents means the hunters are not looking hard enough.
   • BThe program is clearly ineffective because the goal of threat hunting is to find incidents, and if none are found, it is not working.
   • CThe program may be effective even if it does not find incidents, because it provides assurance that certain hypotheses were tested and found not to be present.
   • DThe program should be canceled because it is not generating enough alerts to justify the cost.
   Reveal Solution Discussion Select an answer first