A threat hunter is starting a hunt for a newly discovered malware family that uses a specific command-and-control (C2) domain. The hunter has access to firewall logs, DNS logs, and endpoint process execution logs. According to the basic threat hunting process, what should the hunter do first?

Formulate a hypothesis that hosts in the environment may be communicating with the C2 domain.

Validate the findings by checking if any endpoints have the malware file hash.

Search DNS logs for any queries to the C2 domain.

Collect all logs from the past 30 days into a central repository for analysis.

In the threat hunting process, what is the purpose of the validation step?

To confirm or refute the hypothesis based on evidence

To collect additional raw logs from endpoints

To formulate a new hypothesis for the next hunt

To automatically block all suspicious indicators

An analyst needs to find all log entries where the destination domain contains 'malware' as a substring. Which search technique should be used?

Wildcard search like '*malware*'

Search for 'malware' in uppercase

Search for 'malware' using a regex that matches only the start

An analyst observes a domain in DNS logs and the same domain in proxy logs. What does this correlation indicate?

The user visited the domain multiple times

The domain was resolved and accessed

What is the primary purpose of documenting threat hunting activities?

To replace the need for threat intelligence

To automatically block all identified threats

To satisfy legal requirements only

To provide a reproducible record of the hunt

Palo Alto NetworksCertified Security Operations Professional

Domain 2Objective 8

2.8 Conduct Basic Threat Hunting Based on a Common Indicator Types SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Part of the Threat Intelligence and Incident / Case Response domain, which accounts for 16% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

25questions here

5free pages

6concepts

16%of the exam

Questions 16–20

16application · medium
A threat hunter is starting a hunt for a newly discovered malware family that uses a specific command-and-control (C2) domain. The hunter has access to firewall logs, DNS logs, and endpoint process execution logs. According to the basic threat hunting process, what should the hunter do first?
Select an answer first
17foundation · easy
In the threat hunting process, what is the purpose of the validation step?
Select an answer first
18foundation · easy
An analyst needs to find all log entries where the destination domain contains 'malware' as a substring. Which search technique should be used?
Select an answer first
19foundation · easy
An analyst observes a domain in DNS logs and the same domain in proxy logs. What does this correlation indicate?
Select an answer first
20foundation · easy
What is the primary purpose of documenting threat hunting activities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.