What is the primary goal of threat hunting as a security practice?

To respond to an active incident and contain the damage

To proactively search for hidden threats that evaded existing security controls

To patch vulnerabilities before they are exploited

To collect and analyze threat intelligence feeds

A threat intelligence team receives a STIX bundle from an external sharing community. The bundle contains indicators of compromise (IOCs) related to a new malware family. The team wants to use this intelligence to guide their hunting activities. Which approach best leverages STIX and TAXII for intelligence-driven hunting?

Ignore the STIX bundle because it is not in a proprietary format used by the company's tools.

Manually copy the IOCs from the STIX bundle into a spreadsheet and share it via email.

Convert the STIX bundle to PDF and distribute it to all security analysts for manual review.

Use a TAXII client to automatically ingest the STIX bundle into the SIEM, then create hunting queries based on the IOCs.

What is the key principle behind situational awareness-driven threat hunting?

Using automated tools to replace human analysis

Using knowledge of the organization's environment and assets to identify unusual activities

Relying solely on external threat intelligence feeds

Hunting only on systems that have been compromised before

EC-CouncilThreat Intelligence Essentials

Domain 7Objective 3

Threat Hunting Methodologies and Frameworks TIE Practice Questions (Page 8)

Part of the Threat Hunting and Detection domain, which makes up ~12% of our current practice bank.

53questions here

11free pages

20concepts

20 Concepts in This Objective

Threat Hunting Definition and Goals
Threat Hunting vs. Other Security Processes
Threat Hunting Process Overview
Hypothesis-Driven Hunting
Intelligence-Driven Hunting
Situational Awareness-Driven Hunting
Baseline and Anomaly Detection
Threat Hunting Frameworks Overview
MITRE ATT&CK for Threat Hunting
Diamond Model for Intrusion Analysis
Cyber Kill Chain for Threat Hunting
TAXII and STIX in Hunting
Lockheed Martin Cyber Kill Chain
Unified Kill Chain
MITRE Shield
Hunting Maturity Model (HMM)
Threat Hunting Loop and Iterative Process
Data Sources and Collection for Hunting
Hunting Techniques and Tools
Documentation and Reporting in Hunting

Questions 36–40

36foundation · easy
What is the primary goal of threat hunting as a security practice?
Select an answer first
37application · medium
A threat hunting team is planning a new hunt. They have identified a hypothesis based on a recent threat intelligence report. They are now in the process of gathering relevant data sources and planning their investigation. Which phase of the threat hunting process are they in?
Select an answer first
38application · medium
A threat intelligence team receives a STIX bundle from an external sharing community. The bundle contains indicators of compromise (IOCs) related to a new malware family. The team wants to use this intelligence to guide their hunting activities. Which approach best leverages STIX and TAXII for intelligence-driven hunting?
Select an answer first
39foundation · easy
What is the key principle behind situational awareness-driven threat hunting?
Select an answer first
40foundation · easy
In the Lockheed Martin Cyber Kill Chain, which stage involves the adversary creating a deliverable payload?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Threat Hunting Methodologies and Frameworks TIE Practice Questions (Page 8)

Questions 36–40

What is the primary goal of threat hunting as a security practice?

A threat hunting team is planning a new hunt. They have identified a hypothesis based on a recent threat intelligence report. They are now in the process of gathering relevant data sources and planning their investigation. Which phase of the threat hunting process are they in?

What is the key principle behind situational awareness-driven threat hunting?

In the Lockheed Martin Cyber Kill Chain, which stage involves the adversary creating a deliverable payload?

Keep studying — Threat Hunting and Detection