Threat Hunting Quiz: Can You Master Hypothesis To Hunt?

1. Which hunting technique involves examining historical data to find evidence of past intrusions?

Real-time hunting

Retroactive hunting

Predictive hunting

Incident response hunting

Submit

3. Which of the following best represents the threat hunting cycle?

Hypothesis → Hunt → Investigate → Contain → Report

Alert → Block → Restore → Close

Detect → Isolate → Eradicate → Recover

Plan → Execute → Monitor → Audit

Submit

5. A threat hunter discovers a script execution from a temporary directory. What should they do next?

Ignore it as normal system behavior

Develop a hypothesis around malware execution and search for similar patterns

Archive the finding without investigation

Assume it is a patch management process

6. Which log source would best reveal suspicious process execution and parent-child relationships?

DHCP server logs

Windows Sysmon and Event ID logs

DNS sinkhole logs

Email gateway logs

Submit

8. Which of the following is a valid source for developing hunting hypotheses?

Industry threat reports and vulnerability disclosures

Competitor marketing materials

Social media rumors

Unverified dark web claims

Submit

10. A threat hunter identifies a pattern of failed login attempts followed by successful access. What should they investigate?

Potential credential compromise or brute-force attack

Normal user behavior

Network latency issues

Firewall misconfiguration

11. What is the primary objective of threat hunting?

Respond to alerts generated by SIEM systems

Proactively search for undetected threats within the network

Monitor firewall logs for policy violations

Conduct vulnerability assessments on endpoints

Submit

13. What does 'Crown Jewels' analysis help threat hunters accomplish?

Prioritize hunting efforts on assets of highest value

Identify all network devices

Generate compliance reports

Test disaster recovery procedures

14. Which of the following is a characteristic of effective threat hunting?

Reactive response only to confirmed alerts

Proactive, hypothesis-driven search for hidden threats

Reliance solely on automated tools

Hunting only during business hours

15. An analyst notices unusual outbound connections to a foreign IP address. Which hunting methodology should they apply?

Develop a hypothesis around data exfiltration

Immediately block all outbound traffic

Wait for an alert from the SIEM

Document the finding without further investigation

16. What is the relationship between threat intelligence and threat hunting?

They are identical processes

Threat intelligence informs hypotheses for hunting activities

Threat hunting is used only to gather threat intelligence

They operate independently with no connection

17. Which data source is most valuable for hunting lateral movement activities?

Web proxy logs

DNS query logs

Windows Event Logs and authentication records

Firewall deny rules

18. In threat hunting, 'MITRE ATT&CK' is primarily used for what purpose?

Generating network topology diagrams

Categorizing adversary tactics and techniques

Automating incident response workflows

Scanning for open ports and services

19. Indicators of Compromise (IOCs) include which of the following?

Malicious IP addresses, file hashes, and domain names

Employee access logs and badge swipes

Network bandwidth utilization metrics

System patch levels and OS versions

20. Which of the following best describes a 'hunting hypothesis'?

A documented attack signature used by IDS systems

An educated assumption about potential adversary behavior or IOCs in the environment

A list of all known malware families

A report generated after a security incident

Threat Hunting Quiz: Can You Master Hypothesis to Hunt?

1. Which hunting technique involves examining historical data to find evidence of past intrusions?

2.

What first name or nickname would you like us to use?

2. Threat hunters often use _____ to correlate events across multiple data sources and identify suspicious patterns.

3. Which of the following best represents the threat hunting cycle?

4. The process of mapping adversary tactics to network artifacts is called _____ analysis.

5. A threat hunter discovers a script execution from a temporary directory. What should they do next?

6. Which log source would best reveal suspicious process execution and parent-child relationships?

7. Threat hunting differs from traditional security monitoring in that it is _____ rather than reactive.

8. Which of the following is a valid source for developing hunting hypotheses?

9. The _____ framework provides a structured approach for organizing and sharing threat intelligence.

10. A threat hunter identifies a pattern of failed login attempts followed by successful access. What should they investigate?

11. What is the primary objective of threat hunting?

12. Behavioral analytics and _____ are key data sources for identifying anomalous user activity.

13. What does 'Crown Jewels' analysis help threat hunters accomplish?

14. Which of the following is a characteristic of effective threat hunting?

15. An analyst notices unusual outbound connections to a foreign IP address. Which hunting methodology should they apply?

16. What is the relationship between threat intelligence and threat hunting?

17. Which data source is most valuable for hunting lateral movement activities?

18. In threat hunting, 'MITRE ATT&CK' is primarily used for what purpose?

19. Indicators of Compromise (IOCs) include which of the following?

20. Which of the following best describes a 'hunting hypothesis'?