I85PREP
⌘ K
OffSec Threat Hunter study materials
OffSec Threat Hunter study resources

OffSec Threat Hunter practice questions

One question at a time. Build your OffSec Threat Hunter understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which characteristic most reliably separates an advanced persistent threat (APT) from ordinary opportunistic cybercrime?

  1. Use of a single commodity exploit kit against many random victims
  2. Reliance on spam campaigns to monetize stolen credit cards quickly
  3. Short burst of scanning followed by immediate ransomware encryption
  4. Sustained, goal-directed intrusion activity with long-term access and low detection profile Correct answer.

Explanation

APTs are defined by prolonged, stealthy campaigns with strategic objectives such as espionage or prepositioning, and they maintain persistence over months or years. Opportunistic crime seeks fast monetization with noisy, high-volume tooling and little interest in staying hidden inside one target.

Question 2Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

A threat report states that an intrusion began with a malicious macro document sent to a small set of employees in a defense supplier. Which initial access pattern does this most strongly suggest?

  1. Exploitation of an internet-facing VPN appliance
  2. Drive-by compromise via a watering hole website
  3. Supply chain compromise of a software update channel
  4. Spearphishing attachment against a targeted organization Correct answer.

Explanation

A small, carefully chosen recipient set within one sector is the hallmark of spearphishing, where the lure is tailored to the target. Watering holes and edge-device exploitation would not require a document delivered to specific employees.

Question 3Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which activity is the clearest example of double extortion in a ransomware operation?

  1. Demanding payment in two separate cryptocurrencies simultaneously
  2. Encrypting production servers and publishing stolen data when payment is refused Correct answer.
  3. Encrypting files twice with two different symmetric keys
  4. Sending ransom notes to every employee mailbox in the company

Explanation

Double extortion combines encryption with prior data theft, then leverages the threat of public release to pressure payment. The second lever is disclosure of exfiltrated data, not a second cryptographic layer.

Question 4Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

What does the term ransomware-as-a-service (RaaS) primarily describe?

  1. A managed security provider that recovers encrypted backups for victims
  2. Cloud backup vendors offering immutable snapshots as a service
  3. Operators leasing encryptor tooling and affiliate infrastructure to partners who conduct intrusions Correct answer.
  4. A subscription service that monitors the dark web for leaked credentials

Explanation

In the RaaS model, core developers maintain the malware and leak-site infrastructure while affiliates carry out access and deployment in exchange for a revenue split. The service is criminal outsourcing, not a defensive offering.

Question 5Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which statement best characterizes living-off-the-land (LOTL) tradecraft used by APTs?

  1. Purchasing zero-day exploits for each target environment
  2. Deploying custom kernel rootkits on every compromised host
  3. Encrypting command-and-control traffic with a bespoke protocol only the actor knows
  4. Abusing signed native administration utilities to blend into normal system activity Correct answer.

Explanation

LOTL tradecraft uses tools already present and signed by the OS vendor, such as PowerShell or WMI, so activity resembles legitimate administration. This reduces the need to drop distinctive binaries that defenders can signature.

Question 6Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

In the MITRE ATT&CK framework, what does a technique represent?

  1. A software tool with known hashes and signatures
  2. A defensive control mapped to a compliance requirement
  3. A named intrusion set attributed to a nation-state sponsor
  4. A specific method an adversary uses to achieve a tactical goal Correct answer.

Explanation

Techniques describe how adversaries accomplish objectives such as credential access or lateral movement, and they are grouped under tactics. Intrusion sets and tools are separate object types in ATT&CK.

Question 7Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which pattern most strongly indicates hands-on-keyboard ransomware deployment rather than fully automated encryption?

  1. Automated encryption of a mapped drive within seconds of execution
  2. A ransomware binary that encrypts only the local user profile directory
  3. A single process encrypting files immediately after a phishing document opens
  4. Interactive command execution, credential dumping, and staged encryption across hosts over hours Correct answer.

Explanation

Human operators typically reconnoiter, escalate, move laterally, and stage encryption deliberately, producing interactive artifacts and uneven timing. Automated attacks encrypt quickly and locally with little preceding discovery.

Question 8Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which actor category is most associated with long-dwell espionage campaigns against government and defense networks for intelligence collection rather than financial gain?

  1. Carding forums
  2. State-sponsored APT groups Correct answer.
  3. Ransomware affiliates
  4. Hacktivist collectives

Explanation

State-sponsored groups pursue intelligence, strategic advantage, and prepositioning, which justifies quiet long-term access. Financial and ideological actors have different objectives and operational tempos.

Question 9Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

A security team observes SMB administrative share access followed by service creation on multiple servers using stolen domain administrator credentials. Which ATT&CK tactic best describes this phase?

  1. Initial access
  2. Lateral movement Correct answer.
  3. Resource development
  4. Collection

Explanation

Moving from one compromised host to others using remote execution mechanisms such as admin shares and service creation is lateral movement. The credentials were already obtained, so this is not initial access.

Question 10Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

An analyst finds that a ransomware operator disabled endpoint protection using a signed vulnerable driver, then deleted volume shadow copies before encryption. What do these actions most clearly indicate?

  1. Credential access and discovery prior to exfiltration
  2. Reconnaissance and resource development before intrusion
  3. Command and control and privilege escalation during staging
  4. Defense evasion and inhibition of recovery prior to impact Correct answer.

Explanation

Bring-your-own-vulnerable-driver techniques bypass security controls, and deleting shadow copies removes local restore options, both of which protect the operation and maximize impact. Neither action gathers credentials or establishes external communications.

Question 11Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which indicator most reliably supports attribution of an intrusion to a specific threat group rather than to a copycat?

  1. A single commodity webshell hash seen in many unrelated incidents
  2. Use of PowerShell, which almost every intrusion employs
  3. A ransom note written in English
  4. Consistent overlap of unique tooling, infrastructure patterns, and operational timing across campaigns Correct answer.

Explanation

Attribution relies on correlated, distinctive tradecraft and infrastructure rather than one shared artifact. Commodity tools and widely used utilities are poor discriminators because many actors reuse them.

Question 12Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

A victim receives a ransom demand but the leak site shows only a small sample of files while encryption has locked core servers. What does this pattern most likely reflect?

  1. The operator is a hacktivist with no financial motive
  2. The victim's backups were restored before the leak site was updated
  3. The operator is using stolen data as leverage alongside encryption, possibly bluffing about volume Correct answer.
  4. The operator has no encryption capability and only stole data

Explanation

Double extortion operators often publish partial samples to prove possession and pressure payment, and they may exaggerate how much data they hold. The presence of encrypted core servers confirms encryption capability exists.

Question 13Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which behavior is most characteristic of an APT establishing persistence on a Windows host in a way that survives reboots and credential changes?

  1. Sending a single phishing email to a helpdesk address
  2. Creating a scheduled task that launches a signed binary proxy execution chain Correct answer.
  3. Running a port scan against the internal subnet
  4. Uploading compressed archives to an external file-sharing site

Explanation

Scheduled tasks are a durable persistence mechanism that re-executes on a trigger and can abuse signed binaries to avoid detection. Scanning and exfiltration are separate tactics that do not survive reboot by themselves.

Question 14Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

What is the primary defensive value of tracking ransomware leak-site victim listings?

  1. It provides early warning of exposed victims and insight into targeting and negotiation pressure Correct answer.
  2. It identifies the operator's real-world identity with legal certainty
  3. It prevents future encryption by blocking the leak site domain
  4. It decrypts victim files without paying the ransom

Explanation

Leak-site monitoring reveals who is being named, when data is threatened for release, and which sectors are targeted, which supports victim notification and trend analysis. It does not decrypt data or establish identity conclusively.

Question 15Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

An intrusion shows beaconing every 60 seconds with jitter to a newly registered domain over HTTPS, followed by internal SMB scanning days later. Which sequence best matches these observations?

  1. Lateral movement first, then initial access, then command and control
  2. Exfiltration first, then persistence, then privilege escalation
  3. Command and control established first, then discovery and lateral movement Correct answer.
  4. Impact first, then collection, then resource development

Explanation

Regular jittered beaconing indicates an established C2 channel, after which operators commonly perform internal discovery and move laterally. The timeline shows access already existed before scanning began.

Question 16Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which tool or technique is most directly associated with credential dumping on a Windows host during an APT intrusion?

  1. Accessing LSASS memory to extract cached password hashes Correct answer.
  2. Deleting volume shadow copies
  3. Encoding payloads in Base64 within a script
  4. Creating a scheduled task for persistence

Explanation

LSASS holds authentication material, so reading its memory yields hashes and tickets that enable lateral movement. The other options support evasion, persistence, or obfuscation rather than credential theft.

Question 17Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

A ransomware group claims to have stolen terabytes of data but provides only screenshots of directory listings. How should a threat hunter interpret this claim?

  1. Treat it as unverified and seek corroborating exfiltration evidence in network and endpoint telemetry Correct answer.
  2. Assume no data was taken because no files were published
  3. Accept the volume as proven because directory listings are hard to fabricate
  4. Conclude the group is a state-sponsored APT conducting espionage

Explanation

Screenshots are trivially staged and are used to pressure victims, so claims require validation against actual egress and staging artifacts. Hunters should look for archive creation, transfer volumes, and destination infrastructure.

Question 18Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which combination best describes the affiliate model within a RaaS ecosystem?

  1. Affiliates provide backup services while core operators conduct intrusion
  2. Affiliates supply insurance while core operators supply decryption keys
  3. Affiliates gain access and deploy payloads while core operators maintain the encryptor and leak portal Correct answer.
  4. Affiliates write the encryptor while core operators handle victim negotiations only

Explanation

The division of labor places intrusion and deployment with affiliates and tooling, branding, and leak infrastructure with the core group, with proceeds split. This specialization lowers the skill barrier to entry.

Question 19Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

A hunt team wants to detect APT lateral movement that avoids obvious malware. Which data source combination is most useful?

  1. Email gateway spam scores for inbound messages
  2. Antivirus signature hit counts on workstations
  3. Firewall deny logs for inbound scanning from the internet
  4. Authentication logs and remote service creation events correlated across hosts Correct answer.

Explanation

LOTL lateral movement appears as unusual authentication and remote execution, so correlating logon events with service or task creation across hosts exposes it. Signature counts and perimeter denies rarely capture credentialed internal movement.

Question 20Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which statement about the relationship between initial access brokers and ransomware affiliates is accurate?

  1. Brokers sell validated network access to affiliates who then deploy ransomware Correct answer.
  2. Brokers deploy ransomware and later sell the decryption keys
  3. Brokers negotiate ransom payments on behalf of victims
  4. Brokers provide legal takedown services to victim organizations

Explanation

Initial access brokers specialize in gaining and validating footholds, then sell that access to operators who carry out the intrusion and extortion. This specialization is a defining feature of the current criminal market.

Question 21Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

An actor uses compromised credentials from a prior breach, authenticates over a residential proxy, and avoids any malware on the endpoint. Which detection strategy is most appropriate?

  1. Monitoring for USB device insertion events
  2. Scanning for malicious macros in Office documents
  3. File hash blocklisting of known ransomware binaries
  4. Behavioral analytics on impossible travel, device fingerprint changes, and anomalous resource access Correct answer.

Explanation

Valid-account abuse leaves no malware to hash or scan, so detection must focus on identity and session anomalies such as geography, device posture, and access patterns. Malware-centric controls will not observe this activity.

Question 22Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Which factor most complicates attribution of a ransomware incident to a specific group when multiple affiliates use the same encryptor?

  1. Shared payload code and branding obscure which affiliate conducted the intrusion Correct answer.
  2. Encryptors always embed the affiliate's legal name
  3. Leak sites are unique per affiliate and cannot be shared
  4. Affiliates are prohibited from reusing infrastructure

Explanation

Because one RaaS program supplies the same binary and leak site to many affiliates, the payload identifies the program but not the individual operator. Attribution then depends on intrusion tradecraft and infrastructure rather than the encryptor.

Question 23Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

A defender observes that an intrusion used only signed binaries, native utilities, and stolen credentials, with no custom malware and no unique infrastructure overlap with known groups. What is the most defensible analytic conclusion?

  1. The absence of malware proves the actor is a state-sponsored APT
  2. The intrusion must be an insider threat because no malware was dropped
  3. The tradecraft is consistent with a disciplined intrusion but attribution remains low confidence Correct answer.
  4. The activity is benign administration because all binaries were signed

Explanation

LOTL tradecraft and infrastructure hygiene deliberately strip away the artifacts on which attribution depends, so analysts can describe behavior without naming a group. Confidence should reflect the missing discriminators rather than assumptions about sponsorship.

Question 24Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

During a ransomware response, an analyst finds that encryption was preceded by weeks of quiet discovery, backup catalog enumeration, and selective credential theft. What does this dwell pattern most likely indicate?

  1. A staged, operator-driven intrusion rather than a smash-and-grab automated attack Correct answer.
  2. An automated worm that spread without human involvement
  3. A commodity phishing kit with no post-exploitation
  4. A purely ideological defacement campaign

Explanation

Extended reconnaissance focused on backups and credentials reflects deliberate preparation to maximize impact and inhibit recovery. Automated or opportunistic attacks do not invest weeks in discovery before encryption.

Question 25Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

Why is sector- and region-based victimology analysis of ransomware leak sites valuable to a threat hunting program?

  1. It guarantees the organization will not be targeted
  2. It reveals targeting preferences that inform threat modeling and prioritization of controls Correct answer.
  3. It establishes the criminal liability of the affiliates involved
  4. It provides decryption keys for previously published victims

Explanation

Victimology shows which sectors, sizes, and regions a program or affiliate favors, letting defenders align detection and resilience investments with realistic risk. It does not confer immunity, keys, or legal outcomes.

Question 26Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

A threat intelligence report describes an intrusion where the adversary used only living-off-the-land binaries (LOLBins), stolen credentials, and remote management tools, with no custom malware. Which actor category does this tradecraft most strongly suggest?

  1. Insider threat exfiltrating data for personal gain
  2. Commodity ransomware affiliate focused on rapid encryption
  3. Hacktivist group seeking immediate public disruption
  4. State-sponsored APT conducting long-term espionage Correct answer.

Explanation

State-sponsored APTs prioritize stealth and persistence over rapid impact, so they often avoid custom malware and rely on native tools and valid accounts to blend in. Ransomware affiliates, hacktivists, and insiders typically have different objectives and tradecraft that leave more obvious artifacts or require different access.

Question 27Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

A ransomware incident response reveals that the encryptor binary is identical across victims, but the ransom note contains different contact emails and the leak-site victim pages are managed by different personas. Which structural feature of the ransomware ecosystem best explains these observations?

  1. Ransomware operations are entirely decentralized with no core group or shared codebase.
  2. Affiliates independently develop their own encryptors but share a common leak site.
  3. The core group maintains the encryptor and brand while affiliates handle intrusions and victim communication. Correct answer.
  4. A single centralized group develops and operates all ransomware strains directly.

Explanation

In the RaaS affiliate model, a core group develops and maintains the encryptor and manages the brand and leak site, while affiliates conduct intrusions and often handle negotiation, leading to variations in contact details and victim management. The shared binary across victims reflects the core group's code, whereas the differing personas and emails reflect affiliate-level operations.

Question 28Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

A threat hunter is reviewing network logs for evidence of APT command-and-control and observes periodic HTTPS beacons to a rare external IP address every 5 minutes with 10% jitter. The destination domain was registered 20 days ago and resolves to a hosting provider with no other organizational traffic. Which hunting hypothesis is most appropriate to pursue next?

  1. The pattern suggests a compromised internal host communicating with C2, warranting endpoint triage. Correct answer.
  2. The newly registered domain confirms the traffic is from a state-sponsored APT.
  3. The beacons are likely benign software update checks and can be excluded.
  4. The jitter indicates the traffic is from a known ransomware encryptor and should trigger isolation.

Explanation

Periodic beacons with jitter to a rare, newly registered domain are classic indicators of malware command-and-control, so the next step is to identify and triage the internal host generating the traffic. Attribution to a specific actor type cannot be made from network metadata alone, and benign update checks are unlikely to use a domain registered only 20 days ago with no other traffic.

Question 29Threat actor landscape, including ransomware and Advanced Persistent Threats (APTs)

During a threat hunt, an analyst finds that a ransomware affiliate used a compromised VPN account to gain access, then deployed Cobalt Strike beacons and used RDP to move laterally before encrypting systems. The affiliate's leak-site page claims the attack was conducted by a well-known APT group. How should the analyst assess this claim?

  1. Treat the claim as unverified and focus on the observed tradecraft, which aligns with ransomware affiliate behavior. Correct answer.
  2. Attribute the attack to the APT because the leak-site page is a reliable source of actor identity.
  3. Reject the claim because ransomware affiliates never use APT tooling such as Cobalt Strike.
  4. Accept the claim because the affiliate used Cobalt Strike, which is exclusively used by APTs.

Explanation

Ransomware affiliates often adopt tools and personas associated with APTs to mislead investigators or inflate their reputation, so claims on leak sites should be treated with skepticism. The observed sequence of VPN access, Cobalt Strike, and RDP lateral movement is consistent with affiliate tradecraft, and attribution requires corroborating evidence beyond self-reported claims.

Question 30Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

During proactive threat hunting you observe a Windows process making an outbound TLS connection to a newly registered domain that resolves to an IP with no prior benign history. Which combination of network and endpoint indicators best supports escalation of this finding as a probable command-and-control beacon?

  1. Periodic connections at near-constant intervals to the same rare domain, paired with the parent process being a document reader that spawned a script interpreter Correct answer.
  2. SMB traffic to an internal file server that peaks during business hours
  3. A single burst of many DNS queries for popular CDN hostnames during a browser session
  4. A large one-time HTTPS download from a well-known software vendor update endpoint

Explanation

Beaconing is characterized by repeated connections at regular intervals to the same destination, and an anomalous process lineage such as a document reader spawning a script interpreter strongly indicates malicious execution. Combining a network timing pattern with an endpoint lineage anomaly raises confidence beyond either indicator alone.

Question 31Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

A hunter wants to detect DNS tunneling through a corporate resolver. Which network indicator is most characteristic of DNS tunneling activity?

  1. Numerous TXT or NULL queries with long, high-entropy subdomain labels sent to a single authoritative domain Correct answer.
  2. Repeated PTR lookups for internal RFC1918 addresses during nightly backups
  3. Frequent A record queries for the same popular search engine
  4. Regular MX record lookups performed by a mail gateway

Explanation

DNS tunneling encodes data in query names and record types, producing unusually long, random-looking labels and heavy use of TXT or NULL records against one authoritative domain. Legitimate resolver traffic rarely shows sustained high-entropy subdomains to a single domain.

Question 32Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

You are triaging an endpoint alert where a process has an image path in a user-writable directory and a command line containing an encoded PowerShell argument. Which endpoint indicator most directly supports the hypothesis of malicious execution rather than administrative scripting?

  1. The command line includes a logging parameter writing to a local file
  2. The process runs under a service account at system startup
  3. The parent process is an Office application and the encoded argument is followed by a download cradle referencing a raw IP address Correct answer.
  4. The binary is signed by a trusted publisher and located in System32

Explanation

Office applications spawning PowerShell with encoded commands and a download cradle is a classic malicious execution chain, since normal document workflows do not launch script interpreters that fetch remote payloads. The combination of unusual parentage, obfuscation, and network retrieval elevates the finding.

Question 33Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

Which Windows event or artifact would a hunter query to identify persistence through a newly created scheduled task?

  1. Security event ID 4624 recording a successful logon
  2. Security event ID 4698 recording a scheduled task being created Correct answer.
  3. Security event ID 1102 recording audit log clearing
  4. Security event ID 5156 recording a permitted network connection

Explanation

Event ID 4698 is generated when a scheduled task is registered, making it the primary artifact for detecting task-based persistence. Correlating it with the creating user and task action helps distinguish legitimate automation from adversary persistence.

Question 34Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

A hunter observes an internal host sending SMB connection attempts to many distinct internal hosts on port 445 in a short window, each failing authentication. Which indicator interpretation is most accurate?

  1. This pattern is characteristic of DNS tunneling and should be investigated at the resolver
  2. This pattern is consistent with internal reconnaissance or lateral movement attempts and warrants correlation with logon failure events Correct answer.
  3. This pattern indicates normal print spooler traffic and should be baselined as benign
  4. This pattern proves data exfiltration over SMB and should trigger immediate containment

Explanation

Many short-lived SMB connection attempts across hosts with authentication failures match scanning or lateral movement behavior. The finding should be correlated with failed logon events and the source account to confirm intent.

Question 35Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

Which file-system indicator is most suggestive of a ransomware staging phase before mass encryption begins?

  1. Deletion of temporary browser cache files on user logout
  2. Rapid creation of many files with high-entropy content and a common new extension across multiple directories Correct answer.
  3. Periodic rotation of log files by a known logging service
  4. Creation of a single configuration file in the application install directory

Explanation

Ransomware typically writes or rewrites many files quickly, producing entropy spikes and a uniform new extension across directories. That broad, rapid transformation pattern is the strongest file-system precursor to encryption.

Question 36Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

A hunter is reviewing proxy logs and wants to identify domain fronting, where a client reaches a disallowed host via a permitted front domain. Which observation is the strongest indicator?

  1. The destination port is 443 rather than 80
  2. The TLS Server Name Indication differs from the HTTP Host header for the same connection Correct answer.
  3. The response includes a Content-Encoding header
  4. The request uses HTTP/2 instead of HTTP/1.1

Explanation

Domain fronting relies on a mismatch between the outer TLS SNI and the inner HTTP Host header so that filtering sees only the permitted front domain. Detecting that mismatch in proxy or TLS metadata is the definitive network indicator.

Question 37Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

Which Linux artifact would a hunter inspect first to find a persistent mechanism that re-executes a malicious binary after reboot without using cron?

  1. The user's shell history file
  2. Systemd unit files and their enabled symlinks under the multi-user target Correct answer.
  3. The contents of /var/log/syslog for the last boot
  4. The current output of the uptime command

Explanation

Systemd units, especially enabled symlinks in target directories, are a common reboot-persistence mechanism on modern Linux. Reviewing unit definitions and their ExecStart paths reveals what will run automatically.

Question 38Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

During hunting you find a process with a spoofed parent process identifier, where the recorded parent no longer exists and the creation time ordering is inconsistent. Which technique does this most likely indicate?

  1. Standard process forking by a service manager
  2. Normal thread creation within a single process
  3. Parent process identifier spoofing used to obscure the true launcher Correct answer.
  4. Legitimate process migration during a software update

Explanation

Attackers can specify an arbitrary parent PID when creating a process, producing lineage that conflicts with process creation times or references a nonexistent parent. That inconsistency is the hallmark of PPID spoofing intended to hide the real launcher.

Question 39Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

A hunter wants to detect credential dumping via access to the LSASS process memory. Which endpoint telemetry is most directly relevant?

  1. Registry writes to the Run key
  2. Process access events where a non-system process requests memory-read rights against lsass.exe Correct answer.
  3. File creation events in the Windows Temp directory
  4. Network connections to port 3389

Explanation

Credential dumping tools open LSASS with memory-read permissions, so process-access telemetry capturing the source image and granted access rights is the most direct indicator. Legitimate processes rarely request such access to lsass.exe.

Question 40Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

Which indicator best distinguishes legitimate fast-flux content delivery from malicious fast-flux infrastructure when reviewing passive DNS data?

  1. A domain that resolves only to RFC1918 addresses
  2. A domain whose TTL is measured in hours and whose addresses change monthly
  3. A single domain resolving to a large rotating set of short-lived IP addresses across unrelated netblocks with very low TTLs Correct answer.
  4. A domain resolving to a small stable set of addresses within one cloud provider

Explanation

Malicious fast-flux uses rapidly rotating, short-lived A records spanning many unrelated netblocks to keep infrastructure resilient. Stable small address sets within one provider or long TTLs reflect normal hosting.

Question 41Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

A hunter is correlating proxy logs with endpoint data to find data exfiltration over HTTPS. Which pairing of indicators is most useful?

  1. Repeated NTP synchronization packets to internal time servers
  2. Many small inbound downloads from a popular CDN during a browser session
  3. Frequent LDAP queries to a domain controller during logon
  4. A large, sustained outbound upload from an unusual process to a rare destination, corroborated by endpoint file-read activity Correct answer.

Explanation

Exfiltration over HTTPS appears as sustained outbound volume to an uncommon destination, and endpoint file-read telemetry identifies which process staged the data. Correlating both reduces false positives from ordinary large uploads.

Question 42Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

Which Windows registry location is commonly abused to achieve persistence by launching a program at user logon?

  1. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  2. HKEY_CURRENT_USER\Control Panel\Desktop
  3. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Correct answer.
  4. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Explanation

The Run key under the CurrentVersion path is a well-known autostart location that executes listed programs at logon. Hunters baseline its values and flag unexpected entries.

Question 43Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

A hunter sees an endpoint resolving many algorithmically generated domain names, most of which return NXDOMAIN. Which conclusion is most defensible?

  1. The resolver is caching negative responses correctly and the behavior is benign
  2. The endpoint is performing legitimate software update checks
  3. The endpoint has a misconfigured DNS suffix search list and needs no further review
  4. The pattern is consistent with domain generation algorithm behavior and should be correlated with the querying process Correct answer.

Explanation

DGA malware queries many pseudo-random domains hoping one resolves as a rendezvous point, producing high NXDOMAIN ratios with random-looking labels. Correlating the querying process confirms whether the source is malicious.

Question 44Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

Which indicator most reliably identifies beaconing when jitter is applied to the connection interval?

  1. A single connection per day to a random destination
  2. A statistically consistent interval with low variance relative to the mean after accounting for a bounded random offset Correct answer.
  3. Traffic that only occurs during scheduled backup windows
  4. Completely random inter-arrival times with no central tendency

Explanation

Jitter adds bounded randomness around a base interval, so statistical analysis still reveals a central tendency with limited spread. Pure randomness or single daily connections lack the periodic structure of beacons.

Question 45Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

A hunter wants to identify a malicious service installed for persistence on Windows. Which artifact combination is most relevant?

  1. A scheduled defragmentation task created by the OS
  2. A new printer queue added by a user
  3. A new service registry key with an ImagePath pointing to a binary in a user-writable directory, plus a corresponding 7045 event Correct answer.
  4. A change to the system time zone setting

Explanation

Service-based persistence creates a service registry entry whose ImagePath often references an unusual binary, and the System log records event ID 7045 when the service is installed. Together they confirm the mechanism and the payload path.

Question 46Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

Which network indicator most strongly suggests use of a covert channel over ICMP?

  1. ICMP echo requests with unusually large or variable payloads carrying non-standard data to an external host Correct answer.
  2. ICMP redirect messages from a legitimate gateway
  3. ICMP destination-unreachable messages returned by an internal router
  4. Standard ICMP echo requests at a steady rate to the default gateway

Explanation

ICMP tunneling hides data in the payload of echo requests, producing oversized or variable payloads directed outside the network. Normal echo traffic has small, uniform payloads and stays local.

Question 47Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

A hunter reviewing endpoint telemetry notices a process reading browser credential store files and then making an outbound connection. Which indicator set best supports credential theft followed by exfiltration?

  1. File reads of the browser login database by a non-browser process, followed by an outbound transfer from the same process tree Correct answer.
  2. A browser process writing its own cache files during normal browsing
  3. A backup agent reading user profile data on schedule
  4. An antivirus scanner opening files during a scheduled scan

Explanation

A non-browser process accessing the browser credential database indicates theft, and a subsequent outbound transfer from the same process tree suggests exfiltration. Legitimate readers are the browser itself or sanctioned backup and security tools.

Question 48Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

Which endpoint indicator is most consistent with process injection into a legitimate remote process?

  1. A process loading a signed DLL from its own install directory
  2. A process spawning a child with inherited standard handles
  3. A process opening a file handle for read access
  4. A thread created in a remote process by a source process requesting virtual memory allocation and write rights Correct answer.

Explanation

Injection involves allocating and writing memory in another process and creating a remote thread, which appears as cross-process memory and thread-creation rights. Normal DLL loading and file handling stay within the process's own operations.

Question 49Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

A hunter is baselining outbound traffic and wants to flag possible DNS exfiltration. Which metric computed per host is most useful?

  1. The number of PTR queries issued by the resolver
  2. The average response size of MX records
  3. The ratio of unique subdomain labels to total DNS queries over a time window Correct answer.
  4. The count of AAAA queries for popular domains

Explanation

DNS exfiltration generates many unique encoded subdomain labels under one domain, so the unique-label ratio per host rises sharply. Baselining that ratio highlights hosts whose query diversity departs from normal patterns.

Question 50Network and endpoint Indicators of Compromise (IoCs) for proactive threat detection

Which indicator most directly suggests that an adversary cleared Windows event logs to hinder investigation?

  1. An increase in Kerberos ticket requests at logon
  2. Security event ID 1102 recorded together with a gap in event timestamps Correct answer.
  3. A new local user account created by an administrator
  4. A surge in successful logons during business hours

Explanation

Event ID 1102 is logged when the Security log is cleared, and the accompanying timestamp gap shows missing telemetry. Together they indicate deliberate anti-forensic activity.