6.1 Identify and Describe Key Characteristics of Threat Hunting CYBERSECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations team receives an alert from their SIEM about a known malware signature on a workstation. The analyst on duty quarantines the file and closes the ticket. The team lead wants to ensure that similar threats are not missed in the future. Which action best aligns with the principles of threat hunting?

   • AEscalate the incident to the incident response team for a full forensic investigation.
   • BInitiate a hypothesis-driven investigation to look for other signs of compromise across the network.
   • CRun a vulnerability scan on the affected workstation to identify missing patches.
   • DReview the SIEM rules and update the signature database to catch future variants.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which statement best describes the core premise of threat hunting?

   • AIt is a one-time review performed after a security incident is confirmed.
   • BIt focuses on patching known vulnerabilities to prevent future attacks.
   • CIt assumes a breach has already occurred and actively searches for hidden threats.
   • DIt waits for alerts from automated detection systems before initiating an investigation.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A threat hunter is investigating a hypothesis that an attacker is using legitimate remote management tools to move laterally. Which combination of data sources would be most useful for this investigation?

   • ASIEM alerts and incident tickets.
   • BEndpoint telemetry, authentication logs, and network traffic.
   • CVulnerability scan reports and patch management logs.
   • DFirewall logs and DNS logs only.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A threat hunter is planning a hunt for a new ransomware variant that is believed to use living-off-the-land binaries (LOLBins). They have limited time and resources. Which technique would be most efficient for this hunt?

   • ASearching for all known ransomware signatures in the environment.
   • BBaselining normal use of LOLBins and then investigating deviations.
   • CReviewing all endpoint logs for any suspicious activity.
   • DAnalyzing all network traffic for encrypted connections.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a core characteristic of threat hunting?

   • AIt is proactive, rule-based, linear, and tool-driven.
   • BIt is reactive, hypothesis-driven, iterative, and human-led.
   • CIt is proactive, hypothesis-driven, iterative, and human-led.
   • DIt is reactive, automated, one-time, and machine-led.
   Reveal Solution Discussion Select an answer first