The Threat Hunting Process TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security operations manager wants to explain to the CISO why the organization should invest in a threat hunting team. The CISO asks, 'How is threat hunting different from our existing security monitoring?' Which response best describes the role of threat hunting?

   • AThreat hunting is a proactive search for indicators of compromise and suspicious behavior that may not trigger existing detection rules.
   • BThreat hunting is only performed after a security incident has been confirmed.
   • CThreat hunting is primarily focused on vulnerability scanning and patch management.
   • DThreat hunting is the same as security monitoring but uses more expensive tools.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A threat hunter is investigating a hypothesis that 'a compromised service account is being used to access multiple databases and extract large volumes of data.' The hunter has access to authentication logs, database audit logs, and network flow logs. However, the organization has a strict policy that prohibits accessing the content of the data (e.g., reading the actual database records) due to privacy regulations. Which analysis approach would best validate or refute the hypothesis without violating the policy?

   • ACorrelate the service account's authentication events with database audit logs showing bulk export operations, and compare the volume of data transferred against the account's baseline behavior.
   • BSearch the network flow logs for any connection to external IP addresses, regardless of the account or database.
   • CDisable the service account immediately and then review the logs to see if any other accounts start behaving similarly.
   • DRead the actual database records that were exported to determine if they contain sensitive information.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team wants to implement a threat hunting program to complement their existing security operations. Their primary concern is that attackers are already inside the network and have been undetected for weeks. Which goal should the threat hunting program prioritize to address this concern?

   • AIncreasing the number of alerts generated by the current detection rules.
   • BReplacing the existing SIEM with a more advanced analytics platform.
   • CConducting regular penetration tests to identify exploitable vulnerabilities.
   • DReducing the dwell time of undetected threats by proactively searching for signs of intrusion.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A threat hunter has completed a hunt that found a critical vulnerability in a business application. The hunter needs to report the findings to both the IT operations team and the business executives. The IT team wants to know the technical details to patch the vulnerability, while executives need to understand the business risk. What is the best reporting strategy?

   • ASend a single detailed technical report to both audiences to ensure everyone has the same information.
   • BCreate two reports: one technical with vulnerability details and remediation steps for IT, and one executive summary with risk, potential impact, and recommended actions.
   • COnly report the vulnerability to the IT team and let them decide whether to inform executives.
   • DReport the vulnerability in a public announcement to ensure transparency.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which sequence correctly represents the typical phases of the threat hunting process?

   • AInvestigation → Hypothesis formation → Data collection → Resolution
   • BHypothesis formation → Data collection → Investigation → Resolution
   • CData collection → Hypothesis formation → Resolution → Investigation
   • DResolution → Investigation → Data collection → Hypothesis formation
   Reveal Solution Discussion Select an answer first