Threat Hunting Methodologies and Frameworks TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is hunting for unusual activity in a company that has a strict policy: employees are not allowed to use USB drives. The analyst notices that a specific workstation has been mounting USB devices frequently during off-hours. Which hunting approach is most directly applied here?

   • AHypothesis-driven hunting based on a specific adversary technique
   • BIntelligence-driven hunting using IOCs from a threat feed
   • CBaseline and anomaly detection using historical data
   • DSituational awareness-driven hunting based on knowledge of the environment's policies
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which technique is commonly used in threat hunting to correlate events across multiple data sources?

   • APort scanning
   • BSocial engineering
   • CLog correlation
   • DPassword cracking
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is setting up a baseline for network traffic to detect anomalies. The company has a standard 9-to-5 workday, and most employees work from the office. Which approach would be most effective for establishing a baseline?

   • ACollect network traffic data for one week and calculate average traffic volumes for each hour of the day.
   • BAnalyze only the traffic from the finance department because it is the most sensitive.
   • CSet a static threshold based on the company's internet bandwidth limit.
   • DUse the maximum traffic volume observed in the past month as the baseline threshold.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center (SOC) receives an alert about a potential malware infection on a user's workstation. The on-call analyst immediately isolates the workstation and begins collecting forensic evidence. Meanwhile, a threat hunter wants to determine if the same malware has affected other workstations in the organization. Which statement correctly differentiates the threat hunter's role from the incident responder's role?

   • AThe threat hunter proactively searches for indicators of the malware across the environment, while the incident responder focuses on containing and eradicating the confirmed infection.
   • BThe threat hunter analyzes the malware's code to develop a signature, while the incident responder contains the infection.
   • CThe threat hunter waits for more alerts before taking action, while the incident responder immediately investigates the current alert.
   • DThe threat hunter is responsible for patching the vulnerability that allowed the malware, while the incident responder handles the user notification.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is network traffic a valuable data source for threat hunting?

   • AIt provides a complete record of user keystrokes
   • BIt is the only source of data needed for hunting
   • CIt contains the content of all encrypted communications
   • DIt can reveal communication with command-and-control servers or data exfiltration
   Reveal Solution Discussion Select an answer first