Threat Hunting Methodologies and Frameworks TIE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   During a threat hunting investigation, an analyst identifies a suspicious IP address that has been communicating with several internal hosts. The analyst also finds that the IP address is associated with a known adversary group. Using the Diamond Model, the analyst wants to pivot from the infrastructure to identify other victims. Which approach is most effective?

   • ASearch for other adversary groups that use the same IP address.
   • BSearch for malware samples that share the same file hash as the one found on the internal hosts.
   • CSearch for other IP addresses that have communicated with the same internal hosts.
   • DSearch for other internal hosts that have communicated with the same IP address.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is an example of an active defense technique that MITRE Shield might describe?

   • ADeploying a honeypot to lure attackers
   • BConducting a security awareness training
   • CPatching a known vulnerability
   • DReviewing firewall logs for blocked traffic
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following best describes the iterative nature of the threat hunting loop?

   • AHunts are performed once and then stopped
   • BEach hunt informs the next, creating a cycle of continuous improvement
   • CThe same hunt is repeated identically every time
   • DHunting is only performed when an incident occurs
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security team is analyzing a recent intrusion where the attacker used a remote access tool to maintain persistence. The team wants to identify where they could have disrupted the attack using the Cyber Kill Chain. They have network logs showing the remote access tool communicating with an external IP. Which stage of the Cyber Kill Chain would be the most effective point to disrupt the attack?

   • AInstallation
   • BExploitation
   • CDelivery
   • DCommand and Control
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security organization has a mature threat hunting program that uses automated data collection, advanced analytics, and a dedicated hunting team. However, the team's hunts are not consistently documented, and the results are not shared with other security teams. According to the Hunting Maturity Model (HMM), which area is most likely to be limiting the organization's advancement to a higher maturity level?

   • AInadequate tooling
   • BLack of skilled analysts
   • CInsufficient data sources
   • DLack of formal documentation and feedback processes
   Reveal Solution Discussion Select an answer first