6.1 Identify and Describe Key Characteristics of Threat Hunting CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team wants to automate parts of their threat hunting process to handle a large volume of data. They want to ensure that the automation does not replace human judgment. Which approach best achieves this balance?

   • AUse automation to automatically block any suspicious activity.
   • BUse automation to generate final reports without human review.
   • CUse automation to collect and pre-process data, then have analysts investigate anomalies.
   • DUse automation to replace the need for hypotheses.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A threat hunter is looking for signs of data exfiltration. They suspect an attacker is using DNS tunneling. Which data source would be most critical to analyze?

   • ADNS logs
   • BFirewall logs
   • CVulnerability scan reports
   • DAuthentication logs
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of baselining in threat hunting?

   • ATo establish a normal pattern of activity so that deviations can be identified.
   • BTo replace the need for threat intelligence.
   • CTo ensure that all systems are patched to the same level.
   • DTo automatically block all suspicious traffic.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A threat hunter is investigating a hypothesis that an insider is exfiltrating data via USB drives. They have access to endpoint telemetry and physical security logs. Which approach would be most effective in confirming or refuting this hypothesis?

   • AInterview all employees about their USB usage.
   • BReview all email traffic for large attachments.
   • CCorrelate USB device insertion events with physical access logs to identify anomalies.
   • DCheck network logs for large outbound transfers.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team is considering using a machine learning tool to automatically identify anomalies in network traffic. They want to incorporate this into their threat hunting program. Which statement best describes how this tool should be used?

   • AAs a replacement for human analysts in making final decisions.
   • BAs a way to generate leads that human analysts investigate further.
   • CAs a tool to eliminate the need for hypothesis-driven hunting.
   • DAs a means to automatically contain threats without human input.
   Reveal Solution Discussion Select an answer first