Overview and Importance of Threat Hunting TIE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a primary reason an organization should invest in threat hunting?

   • ATo ensure compliance with all regulatory frameworks automatically.
   • BTo detect unknown threats that evade signature-based and automated detection systems.
   • CTo reduce reliance on security analysts and automate all detection.
   • DTo replace the need for incident response procedures.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company is considering implementing a threat hunting program. The security team has limited staff and budget. They must choose between two options: (A) hiring a dedicated threat hunter, or (B) training existing SOC analysts to perform hunting part-time. The company's main concern is improving detection of unknown threats while maintaining day-to-day operations. Which option is the most balanced approach?

   • AHire a dedicated threat hunter to focus solely on proactive hunting.
   • BDefer the threat hunting program until the budget increases.
   • CTrain existing SOC analysts to perform hunting part-time, integrating hunting into their regular duties.
   • DOutsource threat hunting to a managed security service provider (MSSP).
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat hunter is about to start a new hunting engagement. The hunter has collected data from network logs, endpoint telemetry, and threat intelligence feeds. According to the threat hunting process, what is the first step the hunter should perform?

   • ASearch all logs for any suspicious activity without a predefined idea.
   • BDeploy additional monitoring sensors to collect more data.
   • CImmediately report any anomalies to the incident response team.
   • DFormulate a hypothesis about potential attacker behavior or techniques.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary goal of threat hunting as a proactive security practice?

   • ATo automate the patching of known vulnerabilities across the enterprise.
   • BTo replace the need for traditional security tools such as firewalls and antivirus.
   • CTo identify and mitigate threats before they can cause damage to the organization.
   • DTo respond to an active ransomware outbreak as quickly as possible.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A threat hunter is conducting an engagement and has collected a large amount of endpoint data. The hunter's hypothesis is that a specific adversary uses a particular lateral movement technique. After analyzing the data, the hunter finds no evidence of the technique. However, the hunter notices an unrelated anomaly that could indicate a different threat. What should the hunter do?

   • ADelete the collected data and start a new engagement from scratch to avoid bias.
   • BEscalate the anomaly to incident response immediately without further investigation.
   • CDocument the original hypothesis as not confirmed and close the engagement, ignoring the anomaly.
   • DPivot the investigation to the new anomaly, form a new hypothesis, and continue hunting.
   Reveal Solution Discussion Select an answer first