2.8 Conduct Basic Threat Hunting Based on a Common Indicator Types SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common indicator type used in threat hunting to identify a specific network destination?

   • ARegistry key
   • BDomain name
   • CFile hash
   • DEmail address
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is hunting for a phishing campaign that uses a specific email address as the sender. The analyst wants to identify any internal users who received emails from this address. Which data source and search approach should the analyst use?

   • ASearch endpoint logs for email client activity related to the sender.
   • BSearch DNS logs for queries to the email domain.
   • CSearch email gateway logs for messages with the sender address in the 'from' field.
   • DSearch firewall logs for SMTP traffic to the email server.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A threat hunter is investigating a potential data exfiltration. The hunter finds that a host has been sending large amounts of data to an IP address that is not on any threat list. The hunter also notices that the host recently downloaded a file with a hash that matches a known malware signature. What should the hunter do to assess the severity of the situation?

   • ACorrelate the network traffic with the file hash and check if the file is associated with data exfiltration behavior.
   • BIgnore the IP address because it is not on a threat list.
   • CDocument the findings and close the hunt as inconclusive.
   • DBlock the IP address immediately to stop the data transfer.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is hunting for indicators of compromise (IOCs) in a large dataset of firewall logs. The analyst has a list of suspicious IP addresses and domains. Which search technique would yield the most comprehensive results?

   • ASearch for the domains only, as they are more specific than IP addresses.
   • BSearch for the IP addresses only, as domains are less reliable indicators.
   • CRun separate searches for each indicator and manually combine the results.
   • DUse a query that matches either the IP addresses or the domains in the destination fields.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When reporting threat hunting findings, what is the most important characteristic of the report?

   • AIt is technical only
   • BIt is stored in a ticket system
   • CIt is lengthy
   • DIt is actionable
   Reveal Solution Discussion Select an answer first