Threat Hunting Tool Selection and Techniques TIE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team has a limited budget and needs to hunt for indicators from a recent threat report. They have a SIEM that stores logs for 30 days, an EDR with 90 days of endpoint data, and no TIP. The report contains file hashes, domains, and IP addresses. Which approach is most effective within the constraints?

   • ASearch only the SIEM for all IOCs, accepting the 30-day limit.
   • BPurchase a TIP to manage the IOCs before searching.
   • CSearch the EDR for file hashes and the SIEM for domains and IPs, covering the full 90-day window across both data sources.
   • DSearch only the EDR for all IOCs, ignoring network indicators.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An organization received a threat intelligence report containing a list of malicious file hashes, domains, and IP addresses. The security team wants to search their environment for any matches. Which approach is most efficient?

   • AUse the threat intelligence platform to generate a report and share it with the team.
   • BUpload the IOCs to the SIEM and run a search across endpoint, proxy, and DNS logs for matches.
   • CAsk the EDR vendor to add the IOCs to their global blocklist and wait for alerts.
   • DManually check each hash against a public sandbox and hope for the best.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which threat hunting technique involves starting with a specific theory about how an attacker might operate and then searching for evidence to confirm or refute that theory?

   • AHypothesis-driven hunting
   • BSignature-based detection
   • CAnomaly-based hunting
   • DIOC-based hunting
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company with a mature security program wants to add threat hunting capabilities. They already have a SIEM that collects logs from all critical systems and an EDR on all endpoints. They need to prioritize hunting for advanced persistent threats that may have evaded existing defenses. Which tool addition would be most valuable?

   • AA vulnerability scanner to identify missing patches.
   • BA network traffic analysis tool that provides deep packet inspection and flow data.
   • CA second SIEM from a different vendor to compare alerts.
   • DA user awareness training platform.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst hypothesizes that an attacker is using PowerShell to execute malicious scripts on workstations. The analyst wants to test this hypothesis using available tools. Which combination of tools and data sources would best support this investigation?

   • AFirewall logs and a network intrusion detection system.
   • BEDR alone without any log aggregation.
   • CThreat intelligence platform and a vulnerability scanner.
   • DSIEM with Windows Event Logs (including PowerShell logging) and an EDR that captures script content.
   Reveal Solution Discussion Select an answer first