3.1 Performing Threat Hunting Across Environments PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the role of behavioral data in hypothesis development for threat hunting?

   • AIt helps formulate hypotheses about what anomalous behavior might look like
   • BIt automatically confirms whether a threat is active
   • CIt provides a list of known malware signatures
   • DIt replaces the need for any other data sources
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the main advantage of using Log Analytics over Logs Explorer for threat hunting?

   • ALog Analytics automatically blocks malicious IPs
   • BLog Analytics requires no configuration
   • CLog Analytics provides real-time streaming of all logs
   • DLog Analytics supports SQL-based queries for advanced analysis
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When investigating a potential compromise of a Google Cloud service, which of the following should a threat hunter examine?

   • AThe service's billing information
   • BThe service's documentation
   • COnly the service's performance metrics
   • DService configuration and audit logs
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of using threat intelligence to develop a hypothesis?

   • AA new ransomware group is known to use PowerShell, so we hunt for unusual PowerShell activity
   • BA past incident involved data exfiltration, so we look for similar patterns
   • CA firewall rule is misconfigured, so we check for exposure
   • DA user logged in from a new location, so we investigate
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of a hypothesis developed from behavioral data?

   • AA known malware family uses a specific domain
   • BPast incidents involved phishing emails
   • CA misconfigured firewall might allow unauthorized access
   • DUsers who normally work 9-5 might be compromised if they log in at 3 AM
   Reveal Solution Discussion Select an answer first