A threat hunting team has just completed a hunt that found no malicious activity. The team lead wants to ensure that the effort contributes to future hunts. Which action best supports the continuous threat hunting loop?

Submit a report to management stating that the hunt was a waste of time.

Delete all logs related to the hunt to free up storage space.

Document the hunt's hypothesis, methodology, and findings, then share the results with the broader security team.

Move on to the next hunt without any further action.

Which of the following is an example of an anomaly that a threat hunter might detect using a baseline?

A user logging in from a new location at an unusual time

A firewall blocking an external IP that is on a blocklist

An employee accessing a shared folder they use daily

A server running a scheduled backup every night

What is the primary purpose of endpoint detection and response (EDR) tools in threat hunting?

To collect and analyze endpoint telemetry to detect and investigate suspicious activities

To provide a list of all known malware signatures

To replace the need for network monitoring

To automatically patch vulnerabilities

EC-CouncilThreat Intelligence Essentials

Domain 7Objective 3

Threat Hunting Methodologies and Frameworks TIE Practice Questions (Page 11)

Part of the Threat Hunting and Detection domain, which makes up ~12% of our current practice bank.

53questions here

11free pages

20concepts

20 Concepts in This Objective

Threat Hunting Definition and Goals
Threat Hunting vs. Other Security Processes
Threat Hunting Process Overview
Hypothesis-Driven Hunting
Intelligence-Driven Hunting
Situational Awareness-Driven Hunting
Baseline and Anomaly Detection
Threat Hunting Frameworks Overview
MITRE ATT&CK for Threat Hunting
Diamond Model for Intrusion Analysis
Cyber Kill Chain for Threat Hunting
TAXII and STIX in Hunting
Lockheed Martin Cyber Kill Chain
Unified Kill Chain
MITRE Shield
Hunting Maturity Model (HMM)
Threat Hunting Loop and Iterative Process
Data Sources and Collection for Hunting
Hunting Techniques and Tools
Documentation and Reporting in Hunting

Questions 51–53

51application · medium
A threat hunting team has just completed a hunt that found no malicious activity. The team lead wants to ensure that the effort contributes to future hunts. Which action best supports the continuous threat hunting loop?
Select an answer first
52foundation · easy
Which of the following is an example of an anomaly that a threat hunter might detect using a baseline?
Select an answer first
53foundation · easy
What is the primary purpose of endpoint detection and response (EDR) tools in threat hunting?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Threat Hunting Methodologies and Frameworks TIE Practice Questions (Page 11)

Questions 51–53

A threat hunting team has just completed a hunt that found no malicious activity. The team lead wants to ensure that the effort contributes to future hunts. Which action best supports the continuous threat hunting loop?

Which of the following is an example of an anomaly that a threat hunter might detect using a baseline?

What is the primary purpose of endpoint detection and response (EDR) tools in threat hunting?

Keep studying — Threat Hunting and Detection