Threat Hunting Foundations And Practical Application Practice Tests

Question 1

A network intrusion detection system (IDS) generates 500 alerts per day. After implementing threat hunting, the number of actionable alerts is reduced to 50. By what percentage has the number of actionable alerts been reduced?

Accepted Answer

B. 90%

Answer

A. 10%

Answer

C. 45%

Answer

D. 5%

Question 2

A threat hunter discovers a suspicious process running on a system. They determine that the process has been active for 120 days before detection. What term describes this period of time?

Accepted Answer

Dwell Time

Question 3

Which of the following are key components of a successful threat hunting program? (Select all that apply)

Answer

A. Quality of collected data

Answer

B. Tools used for gathering/analyzing data

Answer

C. Skills of the threat hunter

Answer

D. Number of security tools deployed

Question 4

Threat hunting is a passive security activity focused on reacting to known threats.

Accepted Answer

False

Answer

True

Question 5

A threat hunter hypothesizes that an attacker is using a specific command-and-control (C2) server. They analyze network traffic and find 15 connections to the C2 server in one hour. If the baseline average is 2 connections per hour, what is the percentage increase in connections to the C2 server?

Accepted Answer

C. 650%

Answer

A. 750%

Answer

B. 130%

Answer

D. 150%

Question 6

A threat hunting team identifies a gap in their telemetry data, specifically the absence of detailed process execution logs on critical servers. To address this gap, they implement a new logging policy that captures process start and stop times, command-line arguments, and user context. If the average size of each log entry is 500 bytes, and there are approximately 1000 process executions per server per day, calculate the approximate daily storage requirement (in MB) for the new logs from one server. (Round to the nearest MB)

Accepted Answer

47.7 MB

Question 7

A threat hunter is investigating a potential intrusion and identifies the use of CMSTP. According to MITRE ATT&CK, under which tactics does CMSTP fall?

Accepted Answer

B. Execution and Defense Evasion

Answer

A. Initial Access and Persistence

Answer

C. Command and Control and Exfiltration

Answer

D. Discovery and Lateral Movement

Question 8

A security analyst wants to find information about a specific technique, such as 'System Binary Proxy Execution'. Describe the steps to access detailed information about this technique using the ATT&CK Navigator.

Accepted Answer

Right-click the technique within the ATT&CK Navigator and choose 'View Technique'. This opens a new tab with detailed information.

Question 9

When viewing the details of a specific technique in the ATT&CK Navigator, what type of information is typically provided?

Accepted Answer

C. Threat actors, preventive controls, and external references

Answer

A. Only the MITRE ID and description

Answer

B. Only the MITRE ID and affected platforms

Answer

D. Only the description and mitigation strategies

Question 10

The 'Groups' category in the MITRE ATT&CK Navigator provides information about specific software used by threat actors, but does not provide information about the tactics and techniques they employ.

Accepted Answer

False

Answer

True

Question 11

A threat hunter is using the MITRE ATT&CK framework to formulate a threat hunting hypothesis. Which of the following steps are essential in this process?

Answer

A. Identify techniques used by a specific adversary

Answer

B. Identify the likely data sources for the hunt

Answer

C. Implement all possible preventive controls

Answer

D. Immediately block all identified indicators of compromise

Question 12

A security team is using the MITRE ATT&CK framework to improve their threat hunting capabilities. If they find that they cannot efficiently query the data needed to investigate a specific threat hunting hypothesis, what should they do?

Accepted Answer

Identify opportunities for improvement within their organization, such as improving data collection or query capabilities.

Question 13

A security analyst is using the ATT&CK Navigator to understand the techniques used by a specific threat actor group. After selecting the group, what is the next logical step to identify the techniques?

Accepted Answer

A. Review the techniques highlighted in the Navigator for that group.

Answer

B. Export the Navigator data to a CSV file.

Answer

C. Manually search for the group's name in the technique descriptions.

Answer

D. Filter the techniques by platform (e.g., Windows, Linux).

Question 14

A threat hunter is investigating a potential malware persistence mechanism using Autoruns Sysinternals. They observe a suspicious entry with a file hash value. To assess the risk associated with this file, which of the following actions should the threat hunter prioritize?

Accepted Answer

A. Check the file hash against VirusTotal or HybridAnalysis to identify known malware.

Answer

B. Immediately quarantine the system to prevent further damage.

Answer

C. Analyze the file in a sandbox environment to observe its behavior.

Answer

D. Contact law enforcement to report a potential cybercrime.

Question 15

A security analyst is investigating a potential data exfiltration incident. Network logs show an unusual spike in outbound traffic to an unknown IP address. The analyst needs to determine the volume of data transferred to assess the potential impact. If the outbound traffic peaked at 50 Mbps (Megabits per second) and remained at that level for 15 minutes, calculate the total amount of data transferred in gigabytes (GB). Show your work using MathJax notation.

Accepted Answer

$	ext{Data Transferred (GB)} = \frac{	ext{Rate (Mbps)} 	imes 	ext{Time (seconds)}}{8 	imes 1024 	imes 1024} = \frac{50 	imes 15 	imes 60}{8 	imes 1024 	imes 1024} \approx 0.05368 	ext{ GB}$

Question 16

A threat hunter discovers a series of suspicious PowerShell scripts being executed on multiple endpoints. The scripts appear to be obfuscated and are attempting to download files from external sources. The threat hunter hypothesizes that these scripts are part of a coordinated attack to establish persistence. Is it true or false that the threat hunter should prioritize analyzing the network traffic associated with these endpoints to identify command and control (C2) communication?

Accepted Answer

True

Answer

False

Question 17

During a threat hunt, an analyst identifies a series of anomalous DNS queries originating from an internal server. The queries are directed towards domains with unusual character combinations and newly registered domains. Which of the following actions should the analyst take to further investigate this activity? (Select all that apply)

Answer

A. Analyze the server's process list to identify any unusual or malicious processes.

Answer

B. Immediately block all traffic to the identified domains.

Answer

C. Review the server's DNS logs for patterns of domain generation algorithm (DGA) activity.

Answer

D. Correlate the DNS queries with other network traffic to identify potential command and control (C2) communication.

Answer

E. Assume the server is compromised and immediately re-image it.

Question 18

An organization is using Atomic Red Team to test its defenses against a specific MITRE ATT&CK technique. The test involves executing a PowerShell script that attempts to download a file from an external server. If the organization's EDR solution blocks the download, and the SIEM alerts on the blocked connection, what two conclusions can be drawn about the effectiveness of the organization's detective controls for this specific technique?

Accepted Answer

1. The EDR solution is effectively blocking the specific type of malicious activity emulated by the Atomic Red Team test. 2. The SIEM is successfully detecting and alerting on suspicious network connections, indicating that the organization has visibility into the attempted malicious activity.

Question 19

An analyst is using Caldera to emulate the post-exploitation behavior of APT29. The Caldera instance is configured to use a specific adversary profile that includes techniques such as credential dumping and lateral movement. After running the emulation, the analyst observes that several agents successfully executed the credential dumping ability, but the lateral movement ability failed due to network segmentation. What is the most appropriate next step for the analyst to take, given that the goal is to improve the organization's resilience against APT29?

Accepted Answer

Option A

Answer

Option B

Answer

Option C

Answer

Option D

Question 20

An organization is developing a MITRE ATT&CK Emulation Plan to simulate the behavior of a ransomware group. Which of the following steps are essential for creating an effective emulation plan? (Select all that apply)

Accepted Answer

Option A

Answer

Option B

Answer

Option C

Answer

Option D

Threat Hunting Foundations And Practical Application Practice Tests

Practice Tests

Threat Hunting Foundations and Practical Application

Generate Threat Hunting Foundations And Practical Application practice tests with AI