The Threat Hunting Process TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst at a mid-sized firm notices a spike in outbound DNS queries to a domain that was recently flagged in a threat intelligence feed as a known C2 infrastructure. The analyst wants to start a threat hunt to determine if any host is actually communicating with that domain. Which initial step best aligns with the threat hunting process?

   • AConduct a broad search of all logs from the past year to look for any anomaly.
   • BFormulate a testable hypothesis such as 'A host on the network is beaconing to the flagged C2 domain' and then collect relevant DNS and proxy logs to test it.
   • CWait for the next scheduled vulnerability scan to see if any host is affected.
   • DImmediately block the domain at the firewall and move on to other alerts.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A threat hunter is planning a hunt for a suspected insider threat who may be exfiltrating data via USB drives. The hunter has access to endpoint logs, data loss prevention (DLP) alerts, and physical access logs. The hunter must avoid alerting the suspected insider while gathering enough evidence. Which approach best balances stealth and thoroughness?

   • AImmediately disable the suspect's USB ports and monitor their network activity for anomalies.
   • BReview only the physical access logs to see if the insider was present during the exfiltration times.
   • CConduct an interview with the suspected insider to ask about their USB usage.
   • DForm a hypothesis that the insider is copying files to USB, then correlate DLP alerts with endpoint USB insertion events and physical access logs without taking disruptive action.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst at a mid-sized firm notices that several employees have received spear-phishing emails referencing a recent internal project. The emails contain no malicious attachments or links, but the analyst suspects reconnaissance. The analyst wants to proactively hunt for signs that the attackers have already established a foothold. Which approach best aligns with the threat hunting process?

   • AImmediately block the sender domains and reset passwords for all employees who received the emails, then document the actions taken.
   • BRun a broad search of all logs for the past 90 days to look for any suspicious activity, then report the results to management.
   • CForm a hypothesis that the attackers are using the project name in future phishing lures, then search email gateway logs for similar subject lines.
   • DHypothesize that the spear-phishing is a precursor to credential theft, then review authentication logs and endpoint telemetry for anomalous logins or process executions.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A threat hunter is testing the hypothesis that 'an attacker is using PowerShell to download and execute payloads on Windows endpoints.' The hunter has access to Windows Event Logs, Sysmon logs, and network proxy logs. Which data collection and analysis approach would most effectively validate or refute this hypothesis?

   • ACorrelate PowerShell script block logging (Event ID 4104) with Sysmon process creation (Event ID 1) and network connections (Event ID 3) to identify suspicious download-and-execute patterns.
   • BReview only the network proxy logs for any HTTP POST requests to external IPs.
   • CDisable PowerShell on all endpoints to prevent the attack and then review logs later.
   • DSearch for any event with 'PowerShell' in the message field across all logs.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A threat hunter is planning a hunt based on a recent vulnerability disclosure. The hunter has limited time and wants to follow a structured process. What is the correct sequence of steps for this hunt?

   • AForm a hypothesis, analyze data, collect more data if needed, and then skip documentation if no threat is found.
   • BReport the findings first, then form a hypothesis to justify the report.
   • CForm a hypothesis, collect relevant data, analyze the data, and document the findings.
   • DCollect data, form a hypothesis, analyze the data, and then report the findings.
   Reveal Solution Discussion Select an answer first