Overview and Importance of Threat Hunting TIE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company has a mature security operations center but wants to further enhance its detection capabilities. The management is considering various initiatives. Which initiative would provide the most significant improvement in detecting advanced persistent threats (APTs) that evade traditional controls?

   • ADeploy more intrusion prevention systems (IPS) at the network perimeter.
   • BConduct quarterly red team exercises to test the organization's defenses.
   • CIncrease the number of security analysts to monitor the SIEM around the clock.
   • DImplement a threat hunting program that combines threat intelligence with proactive searches for adversary tactics, techniques, and procedures (TTPs).
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which sequence correctly represents the general steps of a threat hunting engagement?

   • AHypothesis generation → Investigation → Resolution
   • BResolution → Hypothesis generation → Investigation
   • CHypothesis generation → Resolution → Investigation
   • DInvestigation → Hypothesis generation → Resolution
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A threat hunting team is planning a hunt for a new ransomware campaign that uses legitimate administrative tools. The team has limited time and resources. They have identified three potential hypotheses: (H1) attackers use PowerShell to disable security tools, (H2) attackers use scheduled tasks for persistence, and (H3) attackers exfiltrate data via DNS tunneling. The team can only investigate one hypothesis thoroughly. Which hypothesis should the team prioritize to maximize the chance of detecting the ransomware early?

   • AH3: Attackers exfiltrate data via DNS tunneling.
   • BAll three hypotheses are equally important and should be investigated in parallel.
   • CH1: Attackers use PowerShell to disable security tools.
   • DH2: Attackers use scheduled tasks for persistence.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is a recognized benefit of threat hunting for an organization?

   • AIt automatically blocks all malicious IP addresses.
   • BIt ensures compliance with all data protection regulations.
   • CIt provides a complete replacement for antivirus software.
   • DIt improves visibility into network and endpoint activity.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security team has been relying on automated alerts from their SIEM and has not detected any incidents in the past year. However, an external audit reveals that attackers have been present in the environment for several months. The team wants to adopt a more proactive approach. Which practice best exemplifies proactive threat hunting?

   • AReviewing SIEM alerts at the end of each day to identify any that were missed.
   • BSearching endpoint logs for unusual process executions and network connections based on a hypothesis about attacker behavior.
   • CDeploying a new SIEM correlation rule to detect the specific malware used in the audit findings.
   • DIncreasing the number of security analysts to monitor the SIEM dashboard in real time.
   Reveal Solution Discussion Select an answer first