Threat Hunting Tool Selection and Techniques TIE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team wants to create a repeatable threat hunting workflow that includes hypothesis generation, data collection, analysis, and reporting. They have a SIEM, EDR, and a ticketing system. What is the best way to integrate these tools into a cohesive workflow?

   • AUse the EDR as the primary tool and export data to the SIEM only when needed.
   • BReplace the ticketing system with a spreadsheet to track hunting activities.
   • CUse the SIEM for data collection and analysis, the EDR for endpoint data, and manually create tickets for findings.
   • DAutomate the workflow by using APIs to connect the SIEM, EDR, and ticketing system, so that findings automatically generate tickets.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A threat hunter is testing a hypothesis that a compromised service account is being used to access a database at odd hours. The SIEM contains authentication logs, database audit logs, and a baseline of normal access patterns. The hunter wants to confirm the hypothesis with high confidence. Which approach is best?

   • ACorrelate authentication events for the service account with database access logs and compare the times to the established baseline.
   • BDisable the service account immediately and monitor for alerts.
   • CSearch for all failed logon attempts for the service account in the last 30 days.
   • DReview the database audit logs for any queries that returned more than 1000 rows.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A mid-sized company with a small security team wants to start threat hunting. They have a limited budget, a mix of on-premises servers and cloud workloads, and no dedicated security staff to manage complex infrastructure. Their primary data sources are Windows event logs, firewall logs, and Office 365 audit logs. Which tool selection best fits their constraints?

   • ARely solely on the built-in reporting features of Office 365 and the firewall vendor's console.
   • BPurchase a standalone threat intelligence platform and manually upload logs for correlation.
   • CDeploy a full SIEM platform with a dedicated log management cluster and hire an administrator to maintain it.
   • DUse a cloud-based SIEM with pre-built connectors for their data sources and a managed detection and response service.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of IOC-based hunting?

   • ATo discover unknown vulnerabilities in software
   • BTo establish a baseline of normal network behavior
   • CTo search for known malicious indicators across systems and logs
   • DTo test the performance of security tools
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst notices that a server that normally runs at 5% CPU has been at 60% for the past hour. There are no known indicators of compromise for the malware family the analyst suspects. Which hunting technique is most appropriate to investigate this observation?

   • AIOC-based hunting using file hashes from a threat feed.
   • BRun a vulnerability scan on the server to identify missing patches.
   • CHypothesis-driven hunting by formulating a theory about a specific threat actor.
   • DAnomaly-based hunting by comparing current behavior to the established baseline.
   Reveal Solution Discussion Select an answer first