CySA+ Threat Hunting Techniques & Hypotheses

1. Which of the following is a common source of threat intelligence for hypothesis development?

Internal marketing communications

Threat intelligence feeds and industry reports

Social media trending topics

Employee satisfaction surveys

2. Which of the following is essential for successful threat hunting operations?

Collaboration between security analysts and threat intelligence teams

Access to comprehensive logs and network data

Knowledge of threat actor tactics and techniques

All of the above

3. In threat hunting, 'persistence mechanisms' typically refer to:

Methods attackers use to maintain long-term access

Database backup procedures

Network bandwidth optimization

User authentication protocols

4. What role does the 'Kill Chain' model play in threat hunting?

It identifies attack phases where threats can be detected and stopped

It eliminates the need for security monitoring

It is only relevant for incident response

It prevents all types of cyberattacks

5. Which of the following represents a valid threat hunting workflow?

Develop hypothesis → Search for indicators → Analyze findings → Document results

Block all traffic → Generate alerts → Delete logs

Ignore internal alerts → Focus only on external threats

Implement patches → Disable security tools

6. What is the significance of 'False Positive' management in threat hunting?

It reduces unnecessary investigations and improves efficiency

It increases the number of alerts analysts must review

It eliminates all security controls

It requires blocking all detected activity

7. Which hunting methodology is best suited when you have observed a specific IOC in your environment?

Hypothesis-driven hunting

Intelligence-driven hunting

Indicator-driven hunting

Vulnerability-driven hunting

8. In threat hunting, what is 'indicator enrichment'?

Adding context and metadata to indicators for better analysis

Blocking all suspicious indicators automatically

Creating new firewall policies

Removing false positives from alerts

9. Which tool is commonly used for analyzing network traffic during threat hunts?

Splunk or ELK Stack for log analysis

Wireshark for packet capture analysis

Both A and B are commonly used

Only vulnerability scanners like Nessus

10. What does 'data pivoting' mean in the context of threat hunting?

Rotating log files for archival purposes

Following related indicators across multiple data sources

Converting data formats for compliance

Deleting outdated security logs

11. Which of the following best describes the primary goal of threat hunting?

Responding to alerts generated by security tools

Proactively searching for undetected threats within the network

Documenting all network traffic for compliance

Creating firewall rules to block known malware

12. What is the primary purpose of creating a threat model during the hunting process?

To document all network traffic

To identify potential attack paths and likely threat actors

To create firewall rules

To generate compliance reports

13. Which threat hunting technique involves searching for behavioral anomalies?

Signature-based detection

Anomaly-driven hunting

Hash-based matching

Port scanning analysis

14. In threat hunting, what does 'evidence of compromise' (EOC) refer to?

Artifacts indicating a breach has occurred

Potential vulnerabilities in the system

Compliance violations detected by audits

Network bandwidth consumption anomalies

15. Which data source is most valuable for detecting lateral movement within a network?

DNS query logs

Network flow data and authentication logs

Web server access logs

Firewall block lists

16. What is the primary advantage of intelligence-driven threat hunting?

It requires no prior threat knowledge

It focuses on threats relevant to your organization based on threat intelligence

It eliminates the need for technical skills

It guarantees detection of all threats

17. Which of the following is a characteristic of effective threat hunting hypotheses?

Vague and open-ended to allow flexibility

Testable, specific, and based on available data

Focused only on external threats

Limited to known attack patterns

18. In threat hunting, what does the MITRE ATT&CK framework primarily provide?

Real-time malware signatures for antivirus software

A knowledge base of adversary tactics and techniques

Compliance requirements for data protection

Network topology documentation for incident response

19. Which threat hunting approach begins with a specific indicator of compromise (IOC)?