3.1 Performing Threat Hunting Across Environments PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security operations analyst is reviewing user behavior in Google Workspace audit logs. The analyst notices that a finance department user, who typically logs in from the US during business hours, has been accessing the HR document repository at 2:00 AM from an IP address in a country where the company has no presence. The user's account has not had a password change in 90 days. What is the most appropriate next step for the analyst to take?

   • ADocument the anomaly, formulate a hypothesis about potential account takeover, and share the finding with the incident response team for further investigation.
   • BTreat this as a confirmed compromise and escalate directly to law enforcement.
   • CImmediately disable the user's account and reset the password.
   • DIgnore the event because the user may have traveled to that country for personal reasons.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of user behavior analytics (UBA) in threat hunting?

   • ATo block all access from users who exhibit unusual behavior
   • BTo detect deviations from established user behavior patterns that may indicate compromise
   • CTo enforce password policies across the organization
   • DTo replace traditional signature-based detection methods
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of a hypothesis developed from posture data?

   • AA known malware family uses a specific domain, so we search for that domain
   • BA user's account might be compromised because they logged in from a new IP
   • CAn open firewall port might be exploited, so we hunt for connections to that port
   • DA past incident involved phishing, so we look for phishing emails
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of a service log that could reveal a security threat?

   • ACloud CDN logs showing cache hits
   • BCloud Storage bucket access logs showing normal read operations
   • CCloud SQL error logs showing repeated failed login attempts
   • DCloud Functions execution logs showing successful invocations
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a hypothesis developed from incident data?

   • AAn open S3 bucket might be exploited
   • BA known exploit kit uses a specific C2 domain
   • CSince a previous breach used phishing, we hypothesize that new phishing emails may target the same users
   • DA user logging in at an unusual time may indicate compromise
   Reveal Solution Discussion Select an answer first