Threat Hunting Tool Selection and Techniques TIE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A large enterprise has a mature SIEM, an EDR, and a TIP, but the threat hunting team is overwhelmed by manual tasks. They want to automate the correlation of IOCs with historical logs and prioritize alerts. The team has scripting skills but no budget for new commercial tools. Which approach is most effective?

   • APurchase a new SOAR platform to orchestrate the existing tools.
   • BAsk the TIP vendor to provide a custom integration for free.
   • CManually review all alerts from the SIEM and EDR each day.
   • DDevelop custom scripts using the SIEM's API to automatically ingest IOCs from the TIP and run scheduled searches.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A threat hunter hypothesizes that a specific user account was compromised and is being used to access sensitive files at unusual hours. Which set of data sources and analysis technique would best test this hypothesis?

   • ANetwork flow logs to identify all traffic from the user's workstation.
   • BOnly the user's email logs to see if they sent suspicious messages.
   • CAuthentication logs, file access logs, and a comparison of access times against the user's normal working pattern.
   • DA vulnerability scan of the user's machine to check for missing patches.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A small company with a limited budget wants to start threat hunting. They have a SIEM that collects logs from firewalls and servers, but no EDR. They want to focus on IOC-based hunting for known malware. Which tool should they prioritize purchasing?

   • AA network traffic analysis (NTA) tool to monitor network IOCs.
   • BA threat intelligence platform (TIP) to manage IOC feeds.
   • CAn EDR solution to provide endpoint visibility for IOC searches.
   • DA vulnerability scanner to identify weaknesses.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team is integrating a new threat intelligence platform (TIP) with their existing SIEM and EDR. They want to automate the process of enriching alerts with threat intelligence and triggering EDR responses. However, they are concerned about API rate limits and data privacy. Which approach best addresses these concerns?

   • AConfigure the SIEM to send only high-priority alerts to the TIP for enrichment, and use the EDR API to respond only to confirmed threats.
   • BManually review all alerts and then manually enter IOCs into the EDR.
   • CUse the TIP to directly access the EDR and block any IOC without SIEM involvement.
   • DSend all alerts to the TIP for enrichment and have the EDR automatically block all flagged IOCs.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A threat intelligence feed provides a list of malicious IP addresses and domains associated with a recent campaign. The security team wants to determine if any of these indicators have been seen in their environment over the past 90 days. Which tool is best suited for this task?

   • AEDR console to check for endpoint detections.
   • BVulnerability scanner to identify systems that may be affected.
   • CThreat intelligence platform to enrich the IOC list with additional context.
   • DSIEM to search across historical logs for matches against the IOC list.
   Reveal Solution Discussion Select an answer first