2.8 Conduct Basic Threat Hunting Based on a Common Indicator Types SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a threat hunt, an analyst finds that a host resolved a malicious domain and then connected to an IP address that is not on the threat list. The analyst also notices that the host downloaded a file with a hash that matches a known malware signature. What should the analyst conclude?

   • AThe host is not compromised because the IP address is not on the threat list.
   • BThe host is likely compromised, as the domain resolution and file hash are both indicators of malicious activity.
   • CThe findings are inconclusive and require more data before any conclusion can be made.
   • DThe host is compromised only if the IP address is also on the threat list.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During a threat hunt, an analyst finds a file hash in an endpoint log and the same hash in a firewall log's SSL decryption metadata. What does this correlation suggest?

   • AThe firewall blocked the file
   • BThe file is definitely malware
   • CThe file was transferred over the network
   • DThe endpoint is compromised
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the first step in conducting a basic threat hunt?

   • AAnalyze the collected data
   • BCollect data from all sources
   • CValidate the findings
   • DFormulate a hypothesis
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A threat hunter is planning a hunt for a new ransomware strain that is known to use a specific file hash. The hunter has access to endpoint logs, network logs, and email logs. According to the threat hunting process, what should the hunter do after formulating the hypothesis?

   • ACollect relevant data from endpoint logs, network logs, and email logs that could contain the file hash.
   • BImmediately search all logs for the file hash.
   • CValidate the hypothesis by checking if the file hash is present in any logs.
   • DDocument the hypothesis and wait for a confirmed infection before proceeding.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a threat hunt, an analyst finds that several internal hosts resolved a known malicious domain and then connected to an IP address that is also on the threat list. What should the analyst do next to assess the severity of the potential threat?

   • ACorrelate the findings with endpoint data to see if any of the hosts exhibit signs of infection.
   • BImmediately block the IP address and domain on the firewall.
   • CSearch for the same indicators in other log sources to confirm they are present.
   • DDocument the findings and close the hunt as no further action is needed.
   Reveal Solution Discussion Select an answer first