Which of the following is a primary category of threat hunting tools that aggregates and correlates security event data from multiple sources for analysis?

SIEM (Security Information and Event Management)

In hypothesis-driven hunting, what is the first step after formulating a hypothesis?

Identify relevant data sources and queries to test the hypothesis

Delete all logs to reduce noise

Immediately block all network traffic

A security team wants to implement a threat hunting program that includes both proactive hunting for unknown threats and reactive investigation of known indicators. They have a limited budget and need to choose tools that cover both approaches. Which set of tools would best meet their needs?

A threat intelligence platform and a vulnerability scanner.

A network packet capture appliance and a log management system.

A firewall and an antivirus solution.

A security analyst receives an alert about a suspicious domain that is part of a known malware campaign. The analyst wants to determine if any systems in the environment have communicated with that domain. Which tool should the analyst use first?

The EDR console to check for running processes.

The threat intelligence platform to get more context about the domain.

The vulnerability scanner to check for related vulnerabilities.

The SIEM to search proxy and DNS logs for the domain.

Which of the following is an example of an indicator of compromise (IOC) that could be used in IOC-based hunting?

The number of employees in the company

A known malicious file hash (SHA-256)

EC-CouncilThreat Intelligence Essentials

Domain 7Objective 5

Threat Hunting Tool Selection and Techniques TIE Practice Questions (Page 2)

Part of the Threat Hunting and Detection domain, which makes up ~12% of our current practice bank.

40questions here

8free pages

7concepts

Questions 6–10

6foundation · easy
Which of the following is a primary category of threat hunting tools that aggregates and correlates security event data from multiple sources for analysis?
Select an answer first
7foundation · easy
In hypothesis-driven hunting, what is the first step after formulating a hypothesis?
Select an answer first
8application · medium
A security team wants to implement a threat hunting program that includes both proactive hunting for unknown threats and reactive investigation of known indicators. They have a limited budget and need to choose tools that cover both approaches. Which set of tools would best meet their needs?
Select an answer first
9application · medium
A security analyst receives an alert about a suspicious domain that is part of a known malware campaign. The analyst wants to determine if any systems in the environment have communicated with that domain. Which tool should the analyst use first?
Select an answer first
10foundation · easy
Which of the following is an example of an indicator of compromise (IOC) that could be used in IOC-based hunting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.