The Threat Hunting Process TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A threat hunter is about to start a hunt based on a new threat intelligence report about a malware family that uses scheduled tasks for persistence. The hunter has already formulated a hypothesis. According to the threat hunting process, what should the hunter do next?

   • AReport the hypothesis to management and wait for approval before proceeding.
   • BImmediately quarantine all systems that have any scheduled tasks defined.
   • CCollect relevant telemetry such as Windows Event Logs for Task Scheduler (Event ID 4698) and process creation logs to look for indicators of the malware's persistence mechanism.
   • DDevelop a new hypothesis based on the same intelligence report.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is documenting the threat hunting process and findings important?

   • ATo provide a record that can be used to improve future hunts and communicate results to stakeholders
   • BTo replace the need for incident response reports
   • CTo satisfy legal requirements for data retention
   • DTo increase the complexity of the security team's workflow
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which statement best describes threat hunting in a cybersecurity context?

   • AA reactive process that begins after an alert is triggered by a known signature
   • BA proactive search for indicators of compromise and suspicious behavior that may evade existing security controls
   • CA compliance audit that verifies security controls are implemented correctly
   • DA scheduled vulnerability scan that identifies missing patches and misconfigurations
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What does 'reducing dwell time' mean in the context of threat hunting?

   • AShortening the period between an attacker's initial compromise and the organization's detection of that compromise
   • BMinimizing the time required to deploy new security tools
   • CDecreasing the time it takes to patch a vulnerability after it is discovered
   • DReducing the time spent on routine security audits
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A threat hunter has just completed a hunt that found no evidence of the hypothesized malicious activity. The hunter's manager asks for a summary of the work. What should the hunter include in the report to best support future hunts and demonstrate the value of the process?

   • AA recommendation to purchase a new security tool because the current tools failed to detect anything.
   • BA list of all the tools used and a statement that no threats were found, so the hunt is complete.
   • CThe hypothesis, the data sources analyzed, the search logic, the findings, and an explanation of why the hypothesis was not supported.
   • DOnly the final conclusion that the environment is clean, to avoid alarming stakeholders with technical details.
   Reveal Solution Discussion Select an answer first