A security team uses a SIEM and an EDR, but the two tools are not integrated. The team wants to enrich EDR alerts with SIEM context and automatically create hunting queries based on new IOCs. What should they do?

Manually copy EDR alerts into the SIEM and create queries by hand.

Replace the EDR with the SIEM's built-in endpoint detection features.

Use the SIEM's API to pull EDR alerts and the EDR's API to push IOCs, creating a bidirectional integration.

Use a threat intelligence platform to replace both the SIEM and EDR.

A security analyst wants to detect unknown malware that may be exfiltrating data from the network. The analyst has access to NetFlow data and can query the SIEM. Which approach is most appropriate?

Block all outbound traffic to unfamiliar countries.

Search for known malware signatures in the NetFlow data.

Establish a baseline of normal outbound traffic volumes and flag significant deviations to specific external destinations.

Review the firewall's built-in reports for top talkers.

An organization has a limited budget and needs a threat hunting tool. Which approach best aligns with budget constraints while still meeting basic hunting needs?

Purchase the most expensive enterprise platform regardless of fit

Select an open-source SIEM that can ingest existing logs and requires minimal additional hardware

Ignore budget and focus only on features

Choose a tool that requires purchasing all new data sources

A threat hunting team needs to choose a primary technique for a new hunt. They want to detect a known APT group's tactics, but they also want to discover any unknown variants of the group's malware. Which technique should they prioritize?

Hypothesis-driven hunting, using the APT group's known TTPs to formulate a hypothesis and then searching for related behaviors.

IOC-based hunting, using only the known hashes and domains from public reports.

Anomaly-based hunting, with no prior knowledge of the group.

A combination of IOC-based and anomaly-based hunting, ignoring the TTPs.

EC-CouncilThreat Intelligence Essentials

Domain 7Objective 5

Threat Hunting Tool Selection and Techniques TIE Practice Questions (Page 3)

Part of the Threat Hunting and Detection domain, which makes up ~12% of our current practice bank.

40questions here

8free pages

7concepts

Questions 11–15

11foundation · easy
Which threat hunting technique is most effective for detecting previously unknown threats that do not match any known indicators?
Select an answer first
12application · medium
A security team uses a SIEM and an EDR, but the two tools are not integrated. The team wants to enrich EDR alerts with SIEM context and automatically create hunting queries based on new IOCs. What should they do?
Select an answer first
13application · medium
A security analyst wants to detect unknown malware that may be exfiltrating data from the network. The analyst has access to NetFlow data and can query the SIEM. Which approach is most appropriate?
Select an answer first
14foundation · easy
An organization has a limited budget and needs a threat hunting tool. Which approach best aligns with budget constraints while still meeting basic hunting needs?
Select an answer first
15expert · hard
A threat hunting team needs to choose a primary technique for a new hunt. They want to detect a known APT group's tactics, but they also want to discover any unknown variants of the group's malware. Which technique should they prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.