The Threat Hunting Process TIE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of formulating a hypothesis in threat hunting?

   • ATo automate the collection of all available logs
   • BTo prove that the organization has not been compromised
   • CTo replace the need for threat intelligence feeds
   • DTo provide a structured, testable question that guides the investigation
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a primary goal of threat hunting?

   • ATo automate the entire incident response process without human intervention
   • BTo identify and mitigate unknown threats that may have bypassed existing security controls
   • CTo ensure that all security patches are applied within 24 hours of release
   • DTo replace the need for security information and event management (SIEM) systems
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat hunter is investigating a hypothesis that an attacker is using PowerShell to run encoded commands on a few servers. The hunter has access to Windows Event Logs, Sysmon, and network flow logs. Which data collection and analysis approach would most effectively validate or refute the hypothesis?

   • ADisable PowerShell on the servers to prevent any further encoded command execution, then document the change.
   • BSearch Sysmon Event ID 1 for PowerShell processes with suspicious command-line arguments, then correlate with network connections to known malicious IPs.
   • CReview only the Windows Event Log for successful logon events on the servers, because encoded commands require administrative access.
   • DAnalyze network flow logs for large outbound transfers, because encoded PowerShell commands always generate large data transfers.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A threat hunter reads a threat intelligence report stating that a specific APT group is currently using a new DLL side-loading technique. The hunter wants to proactively search the environment for this activity. Which hypothesis is most testable and aligned with the intelligence?

   • AThe APT group's new technique is more sophisticated than any previous technique.
   • BIf the APT group is active in the environment, then some processes will be loading a suspicious DLL from a non-standard path.
   • CThe organization should block all DLL loading to prevent the technique from being used.
   • DThe APT group is likely targeting the organization because it operates in the same industry.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A threat hunter has completed a hunt that successfully identified a new malware variant on a single endpoint. The hunter needs to report the findings to the security operations center (SOC) manager. What is the most important information to include in the report?

   • AThe exact steps the hunter took, including every query and command used, even if they are highly technical.
   • BThe indicators of compromise (IOCs), the affected endpoint, the evidence supporting the finding, and recommended next steps.
   • CA list of all the tools the hunter used and their version numbers.
   • DA summary of the hunter's daily activities during the hunt, including breaks and meetings.
   Reveal Solution Discussion Select an answer first