A security analyst at a mid-sized company notices that several employees in the finance department have recently received phishing emails with subject lines referencing 'invoice overdue'. The emails contain a link that, when clicked, downloads a ZIP file. The analyst wants to proactively hunt for any signs of compromise related to this campaign. Which approach best aligns with hypothesis-driven hunting?

Review the company's vulnerability scan reports to identify missing patches on finance department machines.

Search all email gateway logs for the exact subject line 'invoice overdue' and block the sender addresses.

Formulate a hypothesis that the adversary uses the ZIP file to deliver a payload, then hunt for process creation events from the extracted file across endpoints.

Immediately isolate all finance department workstations and reimage them to ensure no malware persists.

What is the primary purpose of the Cyber Kill Chain in threat hunting?

To provide a list of malware signatures

To automatically stop attacks before they reach the target

To identify the stages of an attack and hunt for indicators at each phase

To replace the need for threat intelligence

What is the correct sequence of the general phases of a threat hunting engagement?

Hypothesis, resolution, investigation

Resolution, hypothesis, investigation

Hypothesis, investigation, resolution

Investigation, hypothesis, resolution

Which activity best exemplifies situational awareness-driven threat hunting?

Patching a known vulnerability in all systems

Searching for a specific malware hash from a threat intelligence feed

Investigating a sudden spike in outbound traffic from a server that normally has low traffic

Reviewing firewall logs for blocked external connections

In MITRE ATT&CK, what is the difference between a tactic and a technique?

A tactic is a specific tool, while a technique is a general approach

A tactic is the adversary's goal, while a technique is the method used to achieve that goal

A tactic is a type of malware, while a technique is a type of vulnerability

A tactic is used by defenders, while a technique is used by attackers

EC-CouncilThreat Intelligence Essentials

Domain 7Objective 3

Threat Hunting Methodologies and Frameworks TIE Practice Questions (Page 3)

Part of the Threat Hunting and Detection domain, which makes up ~12% of our current practice bank.

53questions here

11free pages

20concepts

20 Concepts in This Objective

Threat Hunting Definition and Goals
Threat Hunting vs. Other Security Processes
Threat Hunting Process Overview
Hypothesis-Driven Hunting
Intelligence-Driven Hunting
Situational Awareness-Driven Hunting
Baseline and Anomaly Detection
Threat Hunting Frameworks Overview
MITRE ATT&CK for Threat Hunting
Diamond Model for Intrusion Analysis
Cyber Kill Chain for Threat Hunting
TAXII and STIX in Hunting
Lockheed Martin Cyber Kill Chain
Unified Kill Chain
MITRE Shield
Hunting Maturity Model (HMM)
Threat Hunting Loop and Iterative Process
Data Sources and Collection for Hunting
Hunting Techniques and Tools
Documentation and Reporting in Hunting

Questions 11–15

11application · medium
A security analyst at a mid-sized company notices that several employees in the finance department have recently received phishing emails with subject lines referencing 'invoice overdue'. The emails contain a link that, when clicked, downloads a ZIP file. The analyst wants to proactively hunt for any signs of compromise related to this campaign. Which approach best aligns with hypothesis-driven hunting?
Select an answer first
12foundation · easy
What is the primary purpose of the Cyber Kill Chain in threat hunting?
Select an answer first
13foundation · easy
What is the correct sequence of the general phases of a threat hunting engagement?
Select an answer first
14foundation · easy
Which activity best exemplifies situational awareness-driven threat hunting?
Select an answer first
15foundation · easy
In MITRE ATT&CK, what is the difference between a tactic and a technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.