Perform Threat Hunting Activities NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In TTP-based threat hunting, which component of the TTP framework refers to the specific method or tool an adversary uses to achieve a tactical objective?

   • ATactic
   • BTechnique
   • CProcedure
   • DIndicator
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A threat hunter is using the Pyramid of Pain to evaluate the effectiveness of their detection capabilities. The hunter finds that they can easily block known malicious IPs and domains, but they struggle to detect the adversary's TTPs. Which improvement would have the most impact on increasing the adversary's cost?

   • AExpand the list of blocked IPs and domains
   • BIncrease the frequency of signature updates
   • CDevelop behavioral analytics to detect the adversary's techniques, such as PowerShell abuse or unusual process execution
   • DDeploy more honeypots to attract the adversary
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is hunting for ransomware that may be using a 'double extortion' tactic, where data is exfiltrated before encryption. The team has limited resources and must prioritize their hunting efforts. Which hunting approach would be most effective to detect this threat early?

   • AMonitor for unusual outbound data transfers, especially to cloud storage or file-sharing services
   • BMonitor for the deletion of volume shadow copies
   • CMonitor for the presence of ransomware note files
   • DMonitor for the creation of new scheduled tasks
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which threat hunting model is used to illustrate the increasing difficulty for an adversary when defenders can deny them the use of specific indicators, such as hashes, IP addresses, and domain names?

   • APyramid of Pain
   • BMITRE ATT&CK Navigator
   • CCyber Kill Chain
   • DDiamond Model
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A threat hunter is planning a hunt for a suspected advanced persistent threat (APT) that is known to use living-off-the-land binaries (LOLBins) for execution. Which hunting approach would be most effective?

   • ASearch for known malware file hashes
   • BSearch for new user accounts created in the last 30 days
   • CSearch for unusual usage of built-in Windows tools like PowerShell, WMI, and certutil
   • DSearch for network connections to known malicious IPs
   Reveal Solution Discussion Select an answer first