The Threat Hunting Process TIE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A threat hunter is testing the hypothesis that 'an attacker is using scheduled tasks to maintain persistence on Windows servers.' The hunter has access to Windows Event Logs, but the organization has a policy that limits the retention of logs to 30 days. The hunter suspects the attack may have started more than 30 days ago. What is the most effective way to test the hypothesis given this constraint?

   • AUse only memory forensics on live systems to find scheduled tasks that are currently running.
   • BAssume the hypothesis is true because the logs are insufficient and report the finding as confirmed.
   • CRequest that the organization extend log retention to 365 days before starting the hunt.
   • DAnalyze the available 30 days of logs for scheduled task creation events and correlate them with other suspicious activity, accepting that earlier activity may be missed.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A threat hunter is validating a hypothesis that a specific malware family is present in the environment. The hunter has collected a large amount of data, including process executions, file hashes, and network connections. The initial search for known IOCs returns no matches. What should the hunter do next?

   • AReport that the environment is clean based on the IOC search.
   • BDelete the collected data to free up storage space.
   • CExpand the search to include behavioral indicators, such as unusual process parent-child relationships or file system activity, and consider that the malware may have evolved.
   • DConclude that the malware is not present and close the hunt.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A threat hunter is testing the hypothesis that 'an attacker is using RDP to move laterally between servers.' The hunter has access to Windows Security logs (Event ID 4624 for logon) and network flow logs. Which approach would best validate or refute this hypothesis?

   • ALook for any failed logon attempts on all servers.
   • BSearch for any process named 'mstsc.exe' on all servers.
   • CReview only network flow logs for large data transfers between servers.
   • DCorrelate successful logon events with logon type 10 (RDP) from a single source IP to multiple destination servers within a short time window.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A threat hunter is asked to hunt for a potential data breach involving customer data. The hunter has limited time and must choose between two hypotheses: (1) an external attacker exfiltrated data via the internet, or (2) an insider copied data to a personal cloud storage account. The hunter has access to firewall logs, DLP alerts, and endpoint logs. Which hypothesis should the hunter prioritize, and why?

   • APrioritize the insider hypothesis because the available DLP and endpoint logs can directly detect personal cloud storage uploads, and insider threats often leave different traces than external attacks.
   • BPrioritize the external attacker hypothesis because it is more common and easier to detect with firewall logs.
   • CChoose the hypothesis that is easiest to confirm, regardless of the data sources available.
   • DInvestigate both hypotheses simultaneously with the same data sources, even if it means spending less time on each.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A threat hunt concludes with no evidence of malicious activity, but the hunter noticed several configuration weaknesses that could be exploited in the future. What should the hunter do with these findings?

   • AReport only the configuration weaknesses and omit the fact that the hypothesis was not confirmed.
   • BIgnore the configuration weaknesses because the hunt hypothesis was not confirmed.
   • CInclude the configuration weaknesses in the hunt report as observations and recommendations for hardening.
   • DFix the configuration weaknesses immediately without documenting them.
   Reveal Solution Discussion Select an answer first