CySA+ Threat Hunting Techniques Quiz

1. Which hunting methodology focuses on observable behaviors rather than specific malware signatures?

Signature-based hunting

Behavioral hunting

Rule-based detection

Static analysis

2. What is the key difference between reactive threat hunting and proactive threat hunting?

Proactive searches for threats before detection; reactive responds to alerts

Reactive is faster than proactive

Proactive eliminates all false positives

Reactive requires more resources

3. Which hunting approach combines multiple data sources to identify complex attack patterns?

Siloed analysis

Correlation and fusion

Single-source detection

Manual review only

4. In threat hunting, what does 'indicator confidence' measure?

The likelihood an IOC is associated with actual malicious activity

The speed of threat detection

The cost of security tools

The number of security alerts generated

5. Which technique involves analyzing network traffic patterns to identify command-and-control communications?

Packet inspection

Flow analysis

DNS sinkholing

URL filtering

6. What is the purpose of establishing hunting baselines in security operations?

To create detection thresholds for normal vs. abnormal behavior

To eliminate all security monitoring

To replace incident response teams

To reduce security budget

7. Which log source provides visibility into process execution and parent-child relationships?

DNS logs

Sysmon and process execution logs

Firewall logs

DHCP logs

8. In threat hunting, what does 'persistence mechanism' refer to?

Methods adversaries use to maintain access

Data backup strategies

Network bandwidth allocation

User authentication protocols

9. Which data enrichment technique helps hunters understand the context of suspicious indicators?

Blocking all traffic

Correlation with threat intelligence feeds

Disabling logging

Removing security tools

10. What is the primary advantage of using YARA rules in threat hunting?

They detect behavioral anomalies

They identify malware based on pattern matching

They replace firewall functionality

They eliminate the need for threat intelligence

11. Which threat hunting approach relies on developing educated guesses about potential adversary behavior?

Hypothesis-driven hunting

Signature-based detection

Passive monitoring only

Automated response systems

12. In threat hunting, what is the significance of establishing a timeline?

To correlate events and identify attack sequences

To delay incident response

To reduce storage requirements

To eliminate logging requirements

13. Which Windows event log is most useful for detecting privilege escalation attempts?

Application log

Security log

System log

Setup log

14. What role does threat intelligence play in developing hunting hypotheses?

It provides context about adversary capabilities and TTPs

It replaces the need for log analysis

It eliminates false negatives completely

It only applies to external threats

15. Which hunting technique involves searching for artifacts left by known malware families?

Behavioral analysis

Signature hunting

Anomaly detection

Threat emulation

16. What is anomaly detection in the context of threat hunting?

Identifying deviations from baseline behavior patterns

Blocking all unknown traffic

Reviewing security policies

Creating new firewall rules

17. Which data source is essential for detecting lateral movement within a network?

Web server logs only

Network flow data and authentication logs

Firewall rules alone

Email metadata

18. In threat hunting, what does MITRE ATT&CK framework primarily help hunters do?

Classify and map adversary tactics and techniques

Eliminate false positives automatically

Generate firewall rules

Replace incident response procedures

19. Which indicator of compromise (IOC) is most volatile and changes frequently?

File hashes

IP addresses

Domain names

Registry keys

20. What is the primary purpose of establishing a threat hunting hypothesis?

To eliminate all security alerts

To focus investigative efforts on specific adversary tactics

To replace traditional SIEM tools

To automate all threat detection

CySA+ Threat Hunting Techniques and Hypotheses Quiz