The Threat Hunting Process TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A threat hunter is reviewing a threat intelligence report that describes a new attack campaign using living-off-the-land binaries (LOLBins) to evade detection. The hunter wants to proactively search for this activity in the environment. Which hypothesis is most appropriate for this hunt?

   • AThe organization's firewall is blocking all outbound traffic to known malicious domains.
   • BAttackers are using legitimate Windows binaries such as PowerShell or certutil to carry out malicious activities on endpoints.
   • CAttackers are using a new malware family that has not been seen before.
   • DThe organization's endpoints are all up to date with the latest patches.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A threat hunter is leading a hunt for a suspected advanced persistent threat (APT) that is known to use fileless techniques. The hunter has access to endpoint detection and response (EDR) telemetry, but the EDR does not capture all process command lines. The hunter must decide how to proceed. What is the most effective approach?

   • AFocus only on network traffic, because fileless attacks always communicate over the network.
   • BSupplement EDR telemetry with Windows Event Logs and Sysmon to capture process creation details and command lines, then analyze the combined data.
   • CRely solely on the EDR telemetry and accept that some fileless activity may be missed.
   • DDisable the EDR and use only manual log analysis to avoid missing data.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A threat hunter has completed a hunt that found no evidence of the hypothesized attack, but the hunt did reveal a critical vulnerability in a legacy application that is scheduled for decommissioning in six months. The IT team wants to fix the vulnerability immediately, but the application owner says it cannot be patched without breaking the application. The hunter must document the findings. What is the most appropriate way to report this situation?

   • ADocument the vulnerability, the conflicting constraints (patch vs. break), and recommend a risk-based approach such as implementing compensating controls until the application is decommissioned.
   • BOmit the vulnerability from the report because it was not part of the original hypothesis.
   • CReport the vulnerability as a finding with a recommendation to patch immediately, ignoring the application owner's concern.
   • DReport only the fact that the hypothesis was not confirmed and leave out the vulnerability to avoid conflict.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A threat hunter is investigating a hypothesis that 'a compromised domain controller is being used to dump credentials.' The hunter has access to Windows Security logs, Sysmon logs, and network captures. However, the organization has a strict policy that prohibits the use of offensive tools (e.g., Mimikatz) on the network, even for testing. Which analysis approach would best validate or refute the hypothesis without violating the policy?

   • AReview only the Windows Security logs for account lockouts.
   • BAnalyze Sysmon logs for suspicious process creation events, such as lsass.exe access attempts, and correlate with network captures for unusual SMB traffic.
   • CDisable the domain controller and perform a memory dump to analyze for credentials.
   • DRun Mimikatz on a test domain controller to see if the same technique works.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A threat hunter notices that several servers are making periodic DNS queries to a domain that was recently flagged as malicious by an external feed. The hunter wants to proactively hunt for related activity. Which hypothesis is most appropriate to guide the hunt?

   • AThe servers are communicating with the malicious domain, indicating possible command-and-control activity.
   • BThe organization should immediately block all DNS queries to external domains.
   • CThe DNS queries are caused by a misconfigured application and require no further investigation.
   • DThe malicious domain is actually benign and the feed is incorrect.
   Reveal Solution Discussion Select an answer first