2.8 Conduct Basic Threat Hunting Based on a Common Indicator Types SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A threat hunter has completed a hunt that found no matches for a specific indicator. The hunter needs to document the results. What is the most appropriate way to document this outcome?

   • ADocument the hypothesis, data sources searched, queries used, and the conclusion that no matches were found.
   • BDocument only the queries used, as they may be useful for future hunts.
   • CDo not document the hunt because no findings were made.
   • DReport the hunt as a failure and recommend discontinuing threat hunting.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A threat hunter is conducting a hunt for a new malware variant that is known to use a specific domain for C2. The hunter has collected DNS logs and firewall logs. After analyzing the data, the hunter finds several DNS queries to the domain but no corresponding firewall connections. What should the hunter do next?

   • AConclude that the DNS queries are benign because no firewall connections were made.
   • BImmediately block the domain on the firewall.
   • CValidate the findings by checking if the DNS queries originated from hosts that also show other signs of compromise.
   • DDocument the findings and close the hunt as no threat was found.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An analyst is hunting for a malware campaign that uses a unique URL to download a payload. The analyst has access to proxy logs and endpoint logs. Which combination of data sources and search approach would best identify hosts that accessed the URL?

   • ASearch DNS logs for queries to the URL's domain.
   • BSearch proxy logs for the URL and correlate with endpoint logs for subsequent file executions.
   • CSearch endpoint logs for the URL in process command lines.
   • DSearch firewall logs for traffic to the URL's domain.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which data source is most likely to contain records of outbound connections to a suspicious IP address?

   • AWindows Event Logs
   • BEndpoint antivirus logs
   • CFirewall logs
   • DDNS logs
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During a threat hunt, an analyst encounters a suspicious file. Which indicator type is most directly associated with uniquely identifying that file?

   • AIP address
   • BFile hash
   • CDomain name
   • DEmail address
   Reveal Solution Discussion Select an answer first