Threat Hunting Methodologies and Frameworks TIE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of the Lockheed Martin Cyber Kill Chain?

   • ATo define a standard for sharing threat intelligence
   • BTo describe the stages of a cyber attack from reconnaissance to actions on objectives
   • CTo automate incident response
   • DTo provide a framework for vulnerability management
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does MITRE ATT&CK support threat hunting?

   • ABy providing a structured list of adversary tactics and techniques to guide hypothesis development
   • BBy providing a list of all known vulnerabilities
   • CBy automatically blocking malicious network traffic
   • DBy replacing the need for log analysis
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A threat hunting team is deciding which framework to adopt for their new hunting program. They need a framework that can help them map adversary behaviors to specific tactics and techniques, and also allow them to track the relationships between the adversary, their infrastructure, and the victims. They also want to be able to identify gaps in their detection coverage. Which combination of frameworks would best meet these needs?

   • AMITRE ATT&CK and the Diamond Model
   • BUnified Kill Chain and the Hunting Maturity Model
   • CCyber Kill Chain and MITRE Shield
   • DSTIX and TAXII
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which phase in the Unified Kill Chain represents the adversary's actions after gaining initial access?

   • AWeaponization
   • BReconnaissance
   • CDelivery
   • DLateral movement
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst at a mid-sized firm notices that the organization's threat intelligence feed has published a new advisory about a remote-access trojan that uses PowerShell scripts to download additional payloads from a specific set of domains. The analyst wants to proactively search the environment for signs of this activity before any alerts fire. Which approach best aligns with hypothesis-driven hunting?

   • AQuery endpoint logs for PowerShell execution events that include connections to the domains listed in the advisory, then investigate any hits for further indicators.
   • BRun a vulnerability scan across all endpoints to identify missing patches that could allow the RAT to exploit known vulnerabilities.
   • CWait for the SIEM to generate alerts based on the new indicators, then perform incident response on any triggered alerts.
   • DReview the threat intelligence feed to confirm the domains are still active, then update the firewall blocklist.
   Reveal Solution Discussion Select an answer first