2.8 Conduct Basic Threat Hunting Based on a Common Indicator Types SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When querying firewall logs for a specific IP address, which search technique is most effective?

   • ASearch for the IP address in uppercase
   • BSearch for the IP address with a regex that allows any port
   • CSearch for the exact IP address string
   • DSearch for the IP address with a wildcard at the end
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A threat hunter has completed a hunt that identified multiple hosts communicating with a known malicious IP. The hunter needs to report the findings to management, who are not technical. What is the most effective way to communicate the findings?

   • AProvide a high-level summary of the threat, the number of affected hosts, and the recommended actions in business terms.
   • BProvide only the list of affected hosts and the malicious IP address.
   • CProvide a detailed technical report with all the raw logs and queries used.
   • DProvide a summary of the threat intelligence report that initiated the hunt.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat hunter has completed a hunt that identified a compromised host communicating with a known malicious IP. The hunter needs to report the findings to the incident response team. What should the report include to be most actionable?

   • AOnly the list of affected hosts and the malicious IP address.
   • BA summary of the threat intelligence report that initiated the hunt.
   • CThe hypothesis, data sources used, search queries, findings, and recommended next steps.
   • DThe raw logs that matched the indicators.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst wants to search for evidence of a malicious file executing on a host. Which data source is most appropriate for this search?

   • AEndpoint data
   • BEmail gateway logs
   • CNetwork flow logs
   • DDNS logs
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A threat hunter is investigating a potential compromise. The hunter finds that a host resolved a known malicious domain, but the subsequent connection was to an IP address not on any threat list. Additionally, the host's endpoint logs show a process creating a file with a hash that is not yet flagged as malicious. The hunter must decide whether to escalate to incident response. Given the conflicting indicators, what is the most appropriate action?

   • ADo not escalate because the IP address and file hash are not on any threat list.
   • BEscalate to incident response because the domain resolution and process behavior are suspicious enough to warrant further investigation.
   • CEscalate only if the file hash is confirmed malicious by a sandbox analysis.
   • DWait for additional indicators to appear before escalating.
   Reveal Solution Discussion Select an answer first