The Threat Hunting Process TIE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which type of data is most commonly used in threat hunting to validate a hypothesis?

   • ALogs and telemetry from endpoints, networks, and applications
   • BHuman resources records and employee reviews
   • CMarketing analytics and customer feedback
   • DFinancial statements and budget reports
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat hunter is investigating a hypothesis that an attacker is using living-off-the-land binaries (LOLBins) to move laterally. The hunter has access to Windows Event Logs, Sysmon, and network logs, but the environment has a high volume of legitimate PowerShell and WMI activity. How should the hunter analyze the data to validate the hypothesis without being overwhelmed by false positives?

   • ASearch for all executions of PowerShell and WMI and flag every instance as suspicious.
   • BOnly analyze network logs for SMB connections, because lateral movement always uses SMB.
   • CDisable PowerShell and WMI across the environment to prevent LOLBin abuse.
   • DFocus on LOLBin executions that are unusual for the environment, such as PowerShell or WMI invoked from unexpected parent processes or with suspicious command-line arguments, and correlate with network connections.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A threat hunter has just completed a hunt that confirmed a malware infection on a single workstation. The hunter has documented the findings and reported them to the incident response team. What is the final step in the threat hunting process that the hunter should perform?

   • AImmediately start a new hunt based on the same hypothesis to see if more systems are infected.
   • BVerify that the incident response team has remediated the infection and update the hunt documentation with the outcome.
   • CDelete all logs related to the hunt to protect the organization's privacy.
   • DClose the hunt and move on to the next one, since the findings have been reported.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the main goal of analyzing collected data during a threat hunt?

   • ATo configure new security tools
   • BTo generate a report for senior management
   • CTo validate or refute the hypothesis
   • DTo delete unnecessary logs to save storage space
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A threat hunter at a healthcare organization is planning a hunt for ransomware activity. The organization has a mature SIEM and EDR, but recent attacks in the industry have used legitimate remote management tools (RMM) to perform malicious actions. The hunter must decide which hypothesis to pursue with limited resources. Which hypothesis is most likely to reduce dwell time and detect the threat?

   • AAttackers are exploiting unpatched vulnerabilities in the organization's web servers.
   • BAttackers are using traditional malware that will be detected by the existing EDR signatures.
   • CAttackers are using phishing emails to deliver malicious attachments.
   • DAttackers are using RMM tools such as TeamViewer or AnyDesk to gain remote access and move laterally.
   Reveal Solution Discussion Select an answer first