Threat Hunting Tool Selection and Techniques TIE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of a hypothesis that could be tested in hypothesis-driven hunting?

   • AAn attacker may be using PowerShell to execute scripts in our environment
   • BOur firewall is working correctly
   • CWe have too many logs
   • DThe weather is sunny today
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A mid-sized company with a small security team wants to start a threat hunting program. They have a limited budget, a SIEM that collects firewall and Windows event logs, and no EDR deployed. The team wants to begin with hypothesis-driven hunting focused on lateral movement. Which approach best fits their constraints?

   • APurchase a commercial threat intelligence platform and run IOC sweeps against the SIEM logs.
   • BImplement a network traffic analysis tool to capture full packet captures and analyze them for lateral movement patterns.
   • CUse the existing SIEM to query authentication events and correlate with firewall logs to test hypotheses about lateral movement.
   • DDeploy an open-source EDR on all endpoints and use its built-in hunting queries to test hypotheses about lateral movement.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat hunter suspects that attackers are using PowerShell to download and execute payloads in the environment. The team has Sysmon logs, PowerShell script block logging, and an EDR that can block malicious commands. What is the most effective next step to test this hypothesis?

   • AReview only the EDR alerts from the last 24 hours for any high-severity findings.
   • BSearch the SIEM for PowerShell processes with encoded command lines and correlate with network connections to external IPs.
   • CBlock all PowerShell execution across the organization immediately.
   • DDeploy a new threat intelligence platform to gather more IOCs before searching.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security operations team uses a SIEM, an EDR, and a threat intelligence platform. They want to automate the flow of indicators from the TIP to the SIEM and EDR so that new IOCs are automatically searched and blocked. Which integration approach is most effective?

   • AUse the TIP's API to push IOCs to the SIEM for correlation and to the EDR for blocking, with scheduled synchronization.
   • BConfigure the EDR to send all alerts to the TIP and stop using the SIEM.
   • CManually copy IOCs from the TIP into the SIEM and EDR each week.
   • DReplace the SIEM with the TIP and use it for log analysis.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team receives a list of malicious domains from a trusted source. They want to check if any systems in their environment have communicated with these domains over the past 90 days. Which approach is most efficient?

   • ARun a packet capture on the network for the next 24 hours to see if the domains are accessed.
   • BQuery the SIEM's DNS logs for the list of domains and correlate with endpoint identifiers.
   • CAsk the threat intelligence platform to generate a report of all domains it has seen.
   • DBlock the domains at the firewall and assume any past communication is irrelevant.
   Reveal Solution Discussion Select an answer first