The Threat Hunting Process TIE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A threat hunter is testing the hypothesis that a specific user account is being used by an attacker during off-hours. The hunter has access to authentication logs, VPN logs, and endpoint activity logs. Which data analysis would most directly validate or refute this hypothesis?

   • ACheck whether the user's password has been changed recently.
   • BReview the user's email history to see if they usually work late.
   • CCompare the user's normal login times and locations with recent off-hour logins and correlate with endpoint activity on the user's machine.
   • DDisable the user account to prevent any further off-hour logins.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is an example of a well-formed threat hunting hypothesis?

   • AWe need to buy more security tools.
   • BWe should check all logs for anything unusual.
   • COur organization is secure because we have a firewall.
   • DOur firewall logs may contain evidence of a brute-force attack, so we will review them.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A threat hunter notices that a legitimate application on several workstations is making unusual outbound connections to a cloud storage service at odd hours. The hunter wants to investigate whether this is malicious. Which hypothesis is most testable and appropriate for this scenario?

   • AThe workstations are infected with a cryptocurrency miner.
   • BThe application is performing a scheduled backup that was not documented.
   • CThe application is compromised and is exfiltrating data to the cloud storage service.
   • DThe cloud storage service is down and the application is retrying connections.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What should a threat hunting report include to effectively communicate findings to stakeholders?

   • AThe raw logs in their entirety, without any analysis
   • BA list of all employee usernames and passwords
   • CA summary of the hypothesis, data analyzed, findings, and recommended actions
   • DOnly the final conclusion, without details of the process
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A threat hunter at a financial institution is planning a hunt for data exfiltration. The organization has strict data residency requirements and uses a mix of on-premises and cloud services. The hunter has limited time and must choose between two hypotheses: (1) 'An insider is exfiltrating data via personal webmail' and (2) 'An external attacker is exfiltrating data via encrypted tunnels.' Which hypothesis should the hunter prioritize, given the organization's recent threat intelligence and the need to reduce dwell time?

   • APrioritize the insider webmail hypothesis because it is easier to detect with existing DLP tools.
   • BInvestigate both hypotheses simultaneously with equal effort, splitting the available time.
   • CChoose the hypothesis that requires the least data collection effort, regardless of intelligence.
   • DPrioritize the external attacker encrypted tunnel hypothesis because it aligns with recent threat intelligence about advanced persistent threats targeting financial institutions.
   Reveal Solution Discussion Select an answer first