Threat Hunting Methodologies and Frameworks TIE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of a hypothesis in threat hunting?

   • ATo replace the need for threat intelligence
   • BTo prove that the organization is secure
   • CTo automate the entire hunting process
   • DTo provide a testable statement about potential malicious activity that guides the hunt
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common data source for threat hunting?

   • AFinancial statements
   • BMarketing analytics
   • CHR records
   • DEndpoint logs
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of establishing a baseline in threat hunting?

   • ATo define what is normal so that deviations can be detected
   • BTo ensure all systems have the same configuration
   • CTo provide a list of known malware signatures
   • DTo replace the need for threat intelligence
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What does the Hunting Maturity Model (HMM) assess?

   • AThe compliance level with industry standards
   • BThe organization's capability to perform threat hunting effectively
   • CThe number of security tools deployed
   • DThe severity of current threats
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A threat hunter is investigating a series of suspicious PowerShell commands that were executed on multiple servers. The hunter wants to map these commands to the MITRE ATT&CK framework to understand the adversary's tactics and techniques. Which ATT&CK tactic is most directly associated with the use of PowerShell for script execution?

   • ACommand and Control
   • BPersistence
   • CDefense Evasion
   • DExecution
   Reveal Solution Discussion Select an answer first