3.2 Leveraging Threat Intelligence for Threat Hunting PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of an indicator of compromise (IOC) that can be searched for in historical logs?

   • AA user's display name
   • BA log source type
   • CA timestamp format
   • DA domain name
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following tools can be used to perform retrohunting by comparing historical event data against newly enriched logs?

   • ACloud Storage
   • BGoogle SecOps rules engine
   • CCloud Functions
   • DIdentity-Aware Proxy
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A threat hunter is tasked with proactively identifying potential threats that existing detection rules may miss. The hunter has access to threat intelligence feeds, entity risk scores, and historical logs. Which combination of actions best supports this proactive hunting effort?

   • ARely solely on entity risk scores to identify high-risk entities and investigate them without additional context.
   • BUse threat intelligence to form hypotheses, then search historical logs for related behaviors and prioritize based on entity risk scores.
   • CWait for threat intelligence feeds to provide alerts when new indicators are observed in the environment.
   • DCreate new detection rules based on threat intelligence and run them in live mode to catch future attacks.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is overwhelmed by alerts and wants to improve their triage efficiency. They notice that many alerts are triggered by low-risk entities. The team wants to prioritize investigations based on entity risk scores while ensuring that genuinely suspicious activity is not missed. The team has limited analyst time and needs to reduce alert fatigue. What is the most balanced approach?

   • AAssign all alerts to a single analyst for review, regardless of risk score, to ensure nothing is missed.
   • BIncrease the risk score threshold for all detection rules to reduce the number of alerts generated.
   • CCreate a dashboard that displays alerts grouped by entity risk score, allowing analysts to focus on high-risk entities first while still reviewing lower-risk alerts.
   • DAutomatically suppress all alerts associated with entities that have a risk score below a certain threshold.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team uses Google Threat Intelligence (GTI) feeds to enrich their detection pipeline. An analyst notices that a new GTI feed entry for a malicious IP address has been automatically ingested, but no alert has fired. The analyst wants to determine if any internal hosts have communicated with this IP. What is the most direct way to achieve this?

   • AReview the entity risk score of the internal hosts to see if any have been flagged for suspicious outbound connections.
   • BPerform a UDM search for network events where the destination IP matches the new GTI entry, covering the relevant historical time range.
   • CCreate a new detection rule that references the GTI feed and run it in live mode to generate alerts for future matches.
   • DEnable the GTI feed's automatic retrohunt feature, which will re-evaluate all historical logs against the new feed entry.
   Reveal Solution Discussion Select an answer first