6.1 Identify and Describe Key Characteristics of Threat Hunting CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A threat hunter is looking for signs of a new malware family that uses PowerShell to download payloads. They have no prior indicators of compromise. Which technique would be most effective for this hunt?

   • ASearching for known malware hashes in the environment.
   • BBaselining normal PowerShell usage and then investigating deviations.
   • CReviewing firewall logs for blocked traffic.
   • DWaiting for the SIEM to generate an alert based on existing rules.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary goal of threat hunting?

   • ATo identify and mitigate hidden threats that may have bypassed existing security controls.
   • BTo ensure that all software is patched and up to date.
   • CTo replace traditional security monitoring tools with manual analysis.
   • DTo automate the response to all security incidents without human intervention.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst notices unusual outbound traffic from a server that does not match any known alert. They decide to investigate further by forming a hypothesis and collecting additional logs. Which security process is the analyst performing?

   • AThreat hunting
   • BAutomated detection
   • CVulnerability management
   • DIncident response
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is endpoint telemetry a valuable data source for threat hunting?

   • AIt provides a complete view of all user activity across the organization.
   • BIt is the only data source that can detect malware.
   • CIt replaces the need for network traffic analysis.
   • DIt provides detailed visibility into process execution, file activity, and other host-level behaviors.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A threat hunter wants to use threat intelligence feeds to guide their hunting activities. Which approach best integrates threat intelligence into the hunting process?

   • AAdd the indicators to the SIEM as alert rules.
   • BUse the intelligence to develop hypotheses and search for related activity in the environment.
   • CShare the feed with other organizations without further analysis.
   • DAutomatically block all IP addresses from the feed at the firewall.
   Reveal Solution Discussion Select an answer first