Threat Hunting Workflows & Security Analytics

1. In a threat hunting workflow, what does 'enrichment' refer to?

Adding context and additional data to raw indicators

Deleting suspicious files

Blocking all external traffic

Updating antivirus signatures

2. What is the primary objective of threat hunting as a proactive security measure?

To wait for alerts and respond reactively

To actively search for threats before they trigger alerts

To eliminate all security tools

To reduce security spending

3. Which security control is essential for enabling effective threat hunting across distributed environments?

Centralized logging and log aggregation

Air-gapped networks only

Disabling remote access

Removing all monitoring tools

4. In threat hunting operations, what does 'pivot' mean?

Rotating security staff

Using one indicator to find related indicators and expand investigation scope

Changing firewall rules

Updating antivirus software

5. What is the role of anomaly detection in a threat hunting program?

To identify deviations from normal baseline behavior

To eliminate all user activity

To encrypt all network traffic

To prevent system updates

6. Which communication protocol is commonly abused by attackers for command and control (C2) operations?

HTTPS and DNS

SMTP only

DHCP exclusively

IPv4 header only

7. In threat hunting, what does 'false positive reduction' primarily involve?

Ignoring all security alerts

Tuning detection rules to minimize benign activity triggering alerts

Removing all security controls

Disabling logging systems

8. Which type of malware is most difficult to detect using signature-based approaches?

Polymorphic and zero-day malware

Trojans with known signatures

Viruses from five years ago

Ransomware with static code

9. What is the primary function of a threat hunting playbook?

To document and standardize hunting procedures and techniques

To replace security policies

To block all network traffic

To eliminate the need for monitoring

10. Which data source provides the most granular visibility into process execution and memory activity?

Netflow data

Endpoint Detection and Response (EDR) telemetry

Proxy logs

DNS query logs

11. Which phase of the threat hunting workflow focuses on gathering raw security event data from multiple sources?

Analysis

Collection

Reporting

Escalation

12. Which metric is most important for measuring threat hunting effectiveness?

Number of alerts generated

Mean time to detect (MTTD) and mean time to respond (MTTR)

Total network bandwidth used

Number of security patches applied

13. What is the primary benefit of threat hunting automation in security operations?

Eliminates the need for security analysts

Increases speed and consistency of threat detection

Reduces the need for firewalls

Prevents all cyberattacks

14. Which of the following represents a common adversary behavior pattern used in threat hunting?

Living off the land (using legitimate system tools for attacks)

Immediate system shutdown

Random port scanning

Constant network broadcasting

15. In threat hunting, what does 'hypothesis-driven' hunting mean?

Randomly searching for any suspicious activity

Starting with a specific threat assumption and seeking evidence

Waiting for alerts to trigger investigations

Only hunting on weekends

16. Which log source is most valuable for detecting lateral movement in an enterprise network?

Web server access logs

Windows Event Viewer and authentication logs

Application performance logs

DHCP server logs

17. What is an indicator of compromise (IoC) in threat hunting operations?

A system that is not patched

Observable evidence of malicious activity or intrusion

A user with excessive permissions

A network segment without encryption

18. Which tool is commonly used for security information and event management (SIEM) correlation?

Wireshark

Splunk or ELK Stack

Nmap

Metasploit

19. In threat hunting, what does MITRE ATT&CK framework primarily help security teams accomplish?

Classify and map attacker tactics and techniques

Configure intrusion detection systems

Establish firewall rules

Manage user access controls

20. What is the primary purpose of threat intelligence feeds in security analytics operations?

To encrypt network traffic

To provide indicators of compromise and behavioral patterns

To replace human analysts

To reduce firewall configurations

Security Expert Operationalizing Threat Hunting Workflows Quiz