6.1 Identify and Describe Key Characteristics of Threat Hunting CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team wants to improve their threat hunting efficiency by using automation. They plan to implement a tool that automatically collects and correlates logs from multiple sources. Which statement best describes the role of this automation in threat hunting?

   • AIt replaces the need for human analysts to review data.
   • BIt eliminates false positives, so analysts only see true threats.
   • CIt speeds up data collection and correlation, allowing analysts to focus on analysis.
   • DIt automatically responds to threats, making human intervention unnecessary.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of documenting findings at the end of a threat hunting engagement?

   • ATo create a permanent record that can be used to automate future hunts.
   • BTo share knowledge, improve future hunts, and provide evidence for incident response if needed.
   • CTo prove that the hunt was successful.
   • DTo satisfy regulatory requirements that all hunts be documented.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team has implemented a threat hunting program, but after several months, they have not identified any significant threats. They are considering whether to continue the program. Which factor is most important to consider when evaluating the program's effectiveness?

   • AThe number of threats detected compared to the industry average.
   • BThe number of hypotheses tested and the quality of investigations.
   • CThe cost of the hunting tools and personnel.
   • DThe number of alerts generated by the hunting team.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security manager wants to implement a program that proactively searches for hidden threats that may have evaded existing security controls. The program should assume that the network may already be compromised. Which approach best fits this requirement?

   • AOutsourcing incident response to a third-party firm.
   • BIncreasing the frequency of vulnerability scans across the environment.
   • CDeploying more intrusion detection systems to generate alerts.
   • DImplementing a threat hunting program with a team of analysts who form hypotheses and investigate.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A threat hunter wants to investigate a hypothesis that a specific user account is being used to exfiltrate data via encrypted channels. Which sequence of actions best follows the threat hunting process?

   • AReview the user's past incidents and close the case if no prior alerts exist.
   • BDeploy a new SIEM rule to alert on encrypted traffic from that user, then wait for alerts.
   • CCollect logs from the firewall, proxy, and endpoint, then analyze for anomalies and document findings.
   • DImmediately block the user's access and reset their password to prevent further exfiltration.
   Reveal Solution Discussion Select an answer first