Threat Hunting Tool Selection and Techniques TIE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the first step in anomaly-based threat hunting?

   • ABlocking all suspicious IP addresses
   • BSearching for known malware signatures
   • CEstablishing a baseline of normal behavior
   • DDeleting old logs
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When selecting a threat hunting tool, which factor is most important to ensure the tool can actually use the data your organization already collects?

   • AThe color scheme of the user interface
   • BCompatibility with existing data sources and log formats
   • CThe number of employees at the vendor company
   • DThe vendor's marketing reputation
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which tool category is specifically designed to monitor and respond to malicious activity on individual endpoints, providing visibility into processes, files, and system calls?

   • AFirewall
   • BTicketing system
   • CEDR (Endpoint Detection and Response)
   • DDNS server
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary benefit of integrating threat hunting tools into a cohesive workflow?

   • AIt enables automated data flow and reduces manual effort
   • BIt eliminates the need for security analysts
   • CIt guarantees that all threats will be detected
   • DIt removes the need for threat intelligence
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team has a SIEM with 90 days of log retention and an EDR with 30 days of endpoint data. They receive a threat intelligence report containing IOCs from a campaign that occurred 60 days ago. They want to determine if their environment was compromised. Which approach is most appropriate?

   • AUse the threat intelligence platform to enrich the IOCs and then search the EDR.
   • BSearch the SIEM for the IOCs, since it retains logs from 60 days ago.
   • CWait for the IOCs to appear in future alerts.
   • DSearch the EDR for the IOCs, since it provides endpoint-level detail.
   Reveal Solution Discussion Select an answer first