3.2 Leveraging Threat Intelligence for Threat Hunting PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 3)

Questions 11–13

1. 11expert · hard

   A threat hunter is planning a proactive hunt based on a new threat intelligence report about a supply chain attack. The report describes the use of a specific legitimate software update mechanism to deliver malware. The hunter has access to entity risk scores, historical logs, and threat intelligence feeds. The hunter needs to develop a hunting plan that is both effective and efficient. What is the most appropriate plan?

   • ACreate a detection rule based on the report and run it in live mode to catch future supply chain attacks.
   • BReview entity risk scores for all software update services and investigate any that have high scores.
   • CSearch historical logs for the specific software update mechanism described in the report, then correlate findings with entity risk scores to prioritize.
   • DWait for the threat intelligence feed to provide alerts when the software update mechanism is observed in the environment.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary goal of retrohunting with enriched logs?

   • ATo replace the need for real-time detection
   • BTo reduce the storage cost of logs
   • CTo identify threats that were missed during initial analysis
   • DTo generate compliance reports
   Reveal Solution Discussion Select an answer first
3. 13foundation · easy

   What does an entity risk score primarily indicate?

   • AThe entity's role in the organization
   • BThe total number of alerts generated by an entity
   • CThe entity's network speed
   • DThe likelihood that an entity is involved in malicious activity
   Reveal Solution Discussion Select an answer first