Threat Hunting Tool Selection and Techniques TIE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security analyst is setting up anomaly-based hunting for a network with many false positives in the past. The analyst wants to reduce noise while still detecting true anomalies. Which approach is most effective?

   • ASet very low thresholds to catch any deviation from the baseline.
   • BDisable anomaly detection and rely only on IOC-based hunting.
   • CUse a shorter baseline to make the system more sensitive to changes.
   • DUse a longer baseline period and apply statistical thresholds that account for normal variation, such as standard deviation.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of tool integration in a threat hunting workflow?

   • AWriting reports in a word processor
   • BUsing a standalone scanner that does not share data with other tools
   • CAn EDR automatically sending endpoint alerts to a SIEM for correlation
   • DAn analyst manually copying logs from one system to another
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is planning a threat hunting engagement. The team wants to detect both known malware families and previously unseen malicious behavior. They have a SIEM with historical logs and an EDR that can query endpoints. Which combination of hunting techniques should the analyst use?

   • AIOC-based hunting for known indicators and anomaly-based hunting to establish baselines and find deviations.
   • BAnomaly-based hunting only, using the EDR to flag any process that is not in a baseline.
   • CIOC-based hunting only, searching for hashes and domains from public feeds.
   • DHypothesis-driven hunting only, focusing on a specific attack scenario.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A large organization is evaluating threat hunting tools. They have a high volume of security data, a dedicated hunting team, and a budget that allows for one major tool purchase. They need to support both hypothesis-driven and IOC-based hunting. Which tool category should they prioritize?

   • AAn EDR solution with endpoint detection and response.
   • BA SIEM with advanced analytics and search capabilities.
   • CA threat intelligence platform (TIP) for IOC management.
   • DA network traffic analysis (NTA) tool for network visibility.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A threat hunting team wants to proactively identify threats that are not yet known to the security community. They have access to a SIEM with full packet capture and an EDR. Which technique should be the primary approach?

   • AA combination of IOC-based and hypothesis-driven hunting, ignoring anomalies.
   • BHypothesis-driven hunting, but only using the EDR to look for specific malware families.
   • CAnomaly-based hunting, focusing on deviations from established baselines in network and endpoint behavior.
   • DIOC-based hunting, using public threat feeds to search for known indicators.
   Reveal Solution Discussion Select an answer first