6.1 Identify and Describe Key Characteristics of Threat Hunting CYBERSECURITY-PRACTITIONER Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   Which of the following is a common data source used in threat hunting?

   • AMarketing campaign analytics.
   • BEmployee performance reviews.
   • CNetwork traffic captures and flow records.
   • DHuman resources attendance records.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is threat hunting considered 'iterative'?

   • ABecause it relies on automated tools that run in loops.
   • BBecause the process is repeated and refined based on findings from previous hunts.
   • CBecause it is a linear sequence of steps that never changes.
   • DBecause it is performed only once per year.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is overwhelmed by a high volume of alerts from their SIEM. They want to reduce alert fatigue while ensuring they do not miss hidden threats. They are considering implementing a threat hunting program. Which approach best addresses their goal?

   • AIncrease the sensitivity of SIEM rules to catch more alerts.
   • BImplement a threat hunting program that proactively investigates anomalies and hypotheses.
   • CDisable all SIEM alerts and rely on manual log review.
   • DOutsource all monitoring to a managed security service provider.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A threat hunter is investigating a potential advanced persistent threat (APT) that is using encrypted communication to a command-and-control server. They have network traffic logs but the traffic is encrypted. Which additional data source would be most valuable for this investigation?

   • ADNS logs showing the domain resolved.
   • BEndpoint telemetry, such as process execution and network connections.
   • CFirewall logs showing allowed traffic.
   • DVulnerability scan reports.
   Reveal Solution Discussion Select an answer first