I85PREP
⌘ K
PECB Certified Cyber Threat Analyst study materials
PECB Certified Cyber Threat Analyst study resources

PECB Certified Cyber Threat Analyst practice questions

One question at a time. Build your PECB Certified Cyber Threat Analyst understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts of cyber threat analyst and threat hunting

In threat hunting doctrine, what distinguishes hunting from routine security monitoring such as SIEM alert triage?

  1. Hunting produces firewall blocklists, whereas monitoring produces intelligence reports
  2. Hunting is performed only after an incident is confirmed, whereas monitoring runs continuously
  3. Hunting relies exclusively on automated signature engines, whereas monitoring relies on analyst intuition
  4. Hunting is hypothesis-driven and starts without a pre-existing alert, whereas monitoring reacts to defined detections Correct answer.

Explanation

Threat hunting is a proactive, analyst-led process that begins with a hypothesis about adversary behavior and then searches telemetry for evidence, rather than waiting for a detection to fire. Monitoring and alert triage are reactive workflows driven by predefined rules. This hypothesis-first orientation is the defining characteristic that separates the two activities.

Question 2Fundamental concepts of cyber threat analyst and threat hunting

An analyst uses the MITRE ATT&CK framework during a hunt. Which statement best describes what ATT&CK provides?

  1. A vulnerability scoring system that ranks software flaws by exploitability
  2. A network flow format for exporting packet captures
  3. A curated knowledge base of adversary tactics and techniques observed in real intrusions Correct answer.
  4. A mandatory incident severity scheme used to classify breaches

Explanation

ATT&CK is a structured knowledge base of tactics, techniques, and procedures derived from observed adversary behavior, organized by tactical goals. Analysts use it to map hunches to concrete techniques and to identify coverage gaps. It is not a vulnerability score, a severity scheme, or a data format.

Question 3Fundamental concepts of cyber threat analyst and threat hunting

Which pair correctly matches the intrusion kill chain stage with its typical activity?

  1. Weaponization with the adversary stealing database records
  2. Exfiltration with the adversary establishing initial access
  3. Command and control with the adversary delivering a phishing email
  4. Reconnaissance with the adversary researching the target's public infrastructure Correct answer.

Explanation

In the kill chain model, reconnaissance covers adversary research and targeting of the victim's exposed assets and people. Each later stage has a distinct purpose, so pairing exfiltration with initial access or weaponization with data theft misorders the sequence.

Question 4Fundamental concepts of cyber threat analyst and threat hunting

What is the primary purpose of the Diamond Model in intrusion analysis?

  1. To define the legal retention period for log data
  2. To standardize the syntax of threat intelligence sharing
  3. To describe an event through adversary, infrastructure, capability, and victim with their relationships Correct answer.
  4. To rank vulnerabilities by the likelihood of exploitation in the wild

Explanation

The Diamond Model characterizes every intrusion event as the interaction of four core features: adversary, infrastructure, capability, and victim. Analysts pivot across these vertices to generate new hypotheses and link related events. It is an analytic model, not a scoring, retention, or sharing-format standard.

Question 5Fundamental concepts of cyber threat analyst and threat hunting

A team wants to exchange structured threat intelligence indicators with partners in a machine-readable way. Which standards pairing fits this goal?

  1. PCAP for representing the intelligence and NetFlow for transporting it
  2. STIX for representing the intelligence and TAXII for transporting it Correct answer.
  3. YARA for representing the intelligence and Syslog for transporting it
  4. CVSS for representing the intelligence and CVE for transporting it

Explanation

STIX defines a structured language for cyber threat intelligence objects and their relationships, while TAXII defines a transport protocol for exchanging that content between parties. The other pairings describe scoring, vulnerability identification, packet capture, or pattern matching, none of which provide an intelligence exchange stack.

Question 6Fundamental concepts of cyber threat analyst and threat hunting

Which statement best captures the difference between a threat indicator and a TTP in threat intelligence?

  1. An indicator is always classified, while a TTP is always public
  2. An indicator applies only to insiders, while a TTP applies only to external actors
  3. An indicator describes adversary behavior, while a TTP is a single observable artifact
  4. An indicator is an observable artifact such as a hash, while a TTP describes adversary behavior and methods Correct answer.

Explanation

Indicators are atomic observables, such as file hashes, domains, or IP addresses, that suggest possible compromise. TTPs describe how adversaries operate, including their techniques and procedures, and are generally more durable and harder for adversaries to change than indicators.

Question 7Fundamental concepts of cyber threat analyst and threat hunting

What is the main benefit of the Pyramid of Pain for a threat hunter?

  1. It shows that detecting higher-level behaviors causes adversaries more cost than blocking low-level artifacts Correct answer.
  2. It guarantees that no false positives will occur in detection rules
  3. It proves that hash blocking is the most durable detection method available
  4. It replaces the need for hypothesis generation during a hunt

Explanation

The Pyramid of Pain ranks indicators by how much difficulty an adversary faces when the defender detects and blocks them. Low-level items such as hashes are cheap to change, while higher-level TTPs are costly to alter, so hunters prioritize behavioral detections.

Question 8Fundamental concepts of cyber threat analyst and threat hunting

Which activity is characteristic of a structured threat hunting loop rather than ad hoc searching?

  1. Running a full antivirus scan on all endpoints nightly
  2. Waiting for an alert to fire and then escalating the ticket
  3. Reviewing firewall change requests for policy compliance
  4. Formulating a hypothesis, testing it against data, and refining detections from the findings Correct answer.

Explanation

A structured hunting loop moves from hypothesis through data collection and analysis to the creation of new analytics, then repeats with refined hypotheses. This iterative cycle is what makes hunting a repeatable analytic process instead of opportunistic searching.

Question 9Fundamental concepts of cyber threat analyst and threat hunting

A hunter suspects credential dumping on Windows hosts. Which data source most directly supports testing this hypothesis?

  1. DHCP lease logs recording IP assignments
  2. Wireless controller logs listing associated access points
  3. NetFlow records showing outbound byte volumes
  4. Endpoint telemetry capturing process access to LSASS memory Correct answer.

Explanation

Credential dumping typically involves accessing the LSASS process memory to extract secrets, so endpoint telemetry recording process access to LSASS is the most direct evidence source. Network flow, DHCP, and wireless logs provide context but cannot show process-level access to credential stores.

Question 10Fundamental concepts of cyber threat analyst and threat hunting

During a hunt, an analyst observes periodic outbound HTTPS sessions of nearly identical size every 60 seconds from a server to a rare external domain. Which hypothesis is most analytically sound to pursue first?

  1. The host may be beaconing to command and control infrastructure Correct answer.
  2. The traffic proves insider data theft by an administrator
  3. The host is definitely experiencing a hardware failure
  4. The domain is certainly a legitimate software update source

Explanation

Regular, size-consistent outbound sessions to a rare destination match the pattern of automated beaconing used for command and control. The observation supports a hypothesis to investigate, not a confirmed conclusion, so claims of certainty or unrelated causes should be avoided.

Question 11Fundamental concepts of cyber threat analyst and threat hunting

Which characteristic makes an indicator a poor candidate for long-term detection logic?

  1. It is a file hash that changes whenever the adversary rebuilds the payload Correct answer.
  2. It is a named pipe convention reused across campaigns
  3. It is a behavioral pattern tied to a specific technique
  4. It is a registry modification associated with persistence

Explanation

File hashes are trivially altered by even minor payload changes, so they lose value quickly and sit low on the Pyramid of Pain. Behavioral patterns, persistence mechanisms, and naming conventions tend to persist longer and are better suited to durable detection logic.

Question 12Fundamental concepts of cyber threat analyst and threat hunting

What does the concept of an indicator of compromise lifespan imply for a threat hunting program?

  1. Indicators never expire, so historical blocklists remain equally effective over time
  2. Lifespan applies to malware binaries but not to network infrastructure
  3. Only file hashes have a lifespan, while domains and IP addresses are permanent
  4. Indicators decay quickly, so hunts should emphasize behaviors and validate freshness of intelligence Correct answer.

Explanation

Indicators such as IP addresses, domains, and hashes have limited useful lifetimes because adversaries rotate infrastructure and rebuild payloads. Effective hunting therefore leans on behavioral detections and checks how current the intelligence is before relying on it.

Question 13Fundamental concepts of cyber threat analyst and threat hunting

An analyst wants to test a hypothesis about lateral movement using remote service creation. Which telemetry combination is most relevant?

  1. Printer spooler logs paired with DNS query logs
  2. Asset inventory records paired with patch compliance reports
  3. Service creation events paired with authentication logs showing remote logons Correct answer.
  4. Email gateway logs paired with web proxy cache statistics

Explanation

Remote service creation for lateral movement produces service installation events on the target together with remote authentication records for the source account. Correlating these two sources lets the hunter confirm whether a remote logon actually resulted in a new service.

Question 14Fundamental concepts of cyber threat analyst and threat hunting

Why should a hunter document the hypothesis, data sources, queries, and outcome of each hunt?

  1. To satisfy the requirement that hunts always end in an arrest
  2. To ensure hunts never produce false positives
  3. To replace the need for log retention policies
  4. To enable reproducibility, measure detection coverage, and convert findings into lasting analytics Correct answer.

Explanation

Documentation makes hunts reproducible, lets the team measure which hypotheses and data sources yield value, and supports turning successful hunts into reusable detections. It is a maturity practice, not a legal or error-elimination guarantee.

Question 15Fundamental concepts of cyber threat analyst and threat hunting

A hunter needs to determine whether a suspicious binary was previously seen across the estate. Which approach best answers this question?

  1. Reading the firewall's deny log for the last hour
  2. Querying endpoint telemetry for the file hash and execution history across all hosts Correct answer.
  3. Reviewing the vulnerability scan report for missing patches
  4. Checking the email gateway's spam score configuration

Explanation

Determining prior presence and execution of a binary requires endpoint telemetry that records file hashes and process execution across the fleet. Firewall, vulnerability, and email configuration data do not establish whether a specific binary ran on hosts.

Question 16Fundamental concepts of cyber threat analyst and threat hunting

What is the role of a hypothesis in threat hunting when no intelligence indicates an active compromise?

  1. It removes the need to collect relevant telemetry
  2. It provides a testable, falsifiable statement about adversary behavior that guides data analysis Correct answer.
  3. It replaces the incident response plan during a hunt
  4. It proves the organization has already been breached

Explanation

A hypothesis states a specific, testable expectation about adversary behavior, such as a technique that would appear in telemetry if used. Testing it either supports or refutes the claim, and the result drives further hunting or detection work. It does not assert that a breach occurred.

Question 17Fundamental concepts of cyber threat analyst and threat hunting

Which statement accurately describes the relationship between cyber threat intelligence and threat hunting?

  1. Intelligence consists only of IP blocklists and cannot inform hypotheses
  2. Hunting and intelligence are unrelated processes that never share data
  3. Intelligence fully automates hunting so analysts are no longer needed
  4. Intelligence about adversary behavior can seed hunt hypotheses, and hunt findings can feed back into intelligence Correct answer.

Explanation

Threat intelligence describes adversary behavior and infrastructure that analysts can turn into hunt hypotheses, while hunt results reveal new adversary activity that enriches intelligence. The relationship is bidirectional and analyst-driven, not a replacement for human analysis.

Question 18Fundamental concepts of cyber threat analyst and threat hunting

An analyst receives a report of a new technique but no indicators. How should this information best be used in a hunt?

  1. Wait for an alert to fire before taking any action
  2. Block the reported IP addresses even though none were provided
  3. Derive the observable behaviors the technique would produce and search telemetry for them Correct answer.
  4. Add the report to the blocklist without further analysis

Explanation

When intelligence describes a technique without concrete indicators, the hunter translates the described behavior into observables that telemetry would capture, then searches for them. This is the practical application of behavior-based hunting when atomic indicators are unavailable.

Question 19Fundamental concepts of cyber threat analyst and threat hunting

Which metric best indicates whether a threat hunting program is maturing rather than merely busy?

  1. The number of firewall rules added each month
  2. The count of intelligence feeds subscribed to
  3. The total number of alerts closed per analyst per day
  4. The proportion of hunts that produce new, validated detections or confirmed findings Correct answer.

Explanation

Maturity is reflected in whether hunts generate durable value, such as validated new detections or confirmed adversary findings, rather than raw activity volume. Alert closure counts, firewall changes, and feed subscriptions measure operational load or inputs, not hunting effectiveness.

Question 20Fundamental concepts of cyber threat analyst and threat hunting

A hunter is prioritizing which ATT&CK techniques to test. Which approach best aligns with risk-based hunting?

  1. Prioritize techniques that are easiest to simulate regardless of relevance
  2. Prioritize only techniques that require no telemetry to detect
  3. Prioritize techniques used by threat actors relevant to the organization's sector and exposed assets Correct answer.
  4. Prioritize techniques in alphabetical order to ensure systematic coverage

Explanation

Risk-based hunting focuses effort on adversary behaviors that are most likely to affect the organization, based on sector targeting and exposed assets. Alphabetical or convenience-driven selection ignores relevance and wastes limited hunting capacity.

Question 21Fundamental concepts of cyber threat analyst and threat hunting

Which statement best describes the concept of a threat actor's campaign in threat analysis?

  1. A single malware sample analyzed in isolation
  2. A vulnerability disclosure published by a vendor
  3. A firewall rule set applied to a network segment
  4. A set of related intrusions conducted by the same actor toward a common objective over a period of time Correct answer.

Explanation

A campaign groups related malicious activity by the same actor, sharing infrastructure, tooling, or objectives across a time span. This grouping lets analysts connect seemingly separate incidents and attribute them to a common effort. A single sample, a disclosure, or a firewall policy does not constitute a campaign.

Question 22Fundamental concepts of cyber threat analyst and threat hunting

An analyst observes a host resolving a domain that was registered three days ago and is contacted only by that host. Which analytic conclusion is most defensible?

  1. The observation is suspicious and warrants correlation with process and authentication telemetry Correct answer.
  2. The domain is benign because it resolves successfully
  3. The domain registration date proves nation-state involvement
  4. The host is compromised and data has been exfiltrated

Explanation

Newly registered domains contacted by a single host are a recognized suspicious pattern, but the observation alone does not establish compromise or exfiltration. The defensible next step is to correlate with process execution and authentication data to build evidence.

Question 23Fundamental concepts of cyber threat analyst and threat hunting

A hunt produces no evidence of the hypothesized technique across available telemetry. What is the most rigorous interpretation?

  1. The technique was not observed within the visibility and time range of the data, which may reflect coverage gaps Correct answer.
  2. The organization is definitively immune to that technique
  3. The hypothesis was invalid and hunting should be abandoned
  4. The adversary must have used a different technique outside the model

Explanation

Absence of evidence is bounded by the telemetry available and the period examined, so a negative result may indicate a visibility gap rather than genuine absence of activity. Rigorous analysis states these limits and considers improving coverage before drawing stronger conclusions.

Question 24Fundamental concepts of cyber threat analyst and threat hunting

Two hunters reach different conclusions from the same telemetry. Which practice best supports rigorous resolution of the disagreement?

  1. Selecting the conclusion of the more senior analyst without review
  2. Averaging the two conclusions into a single verdict
  3. Structuring the competing hypotheses and evaluating which evidence discriminates between them Correct answer.
  4. Discarding the telemetry because it produced disagreement

Explanation

Analysis of competing hypotheses requires laying out the rival explanations and assessing which evidence supports or contradicts each, so the conclusion rests on discriminating evidence rather than authority. Averaging verdicts or discarding data avoids the analytic work and can entrench error.

Question 25Fundamental concepts of cyber threat analyst and threat hunting

An indicator feed contains an IP address that is also a large public cloud provider's shared egress range. How should a hunter treat it?

  1. Use it as the sole basis for attributing the activity to a specific actor
  2. Assume the indicator is malicious because it came from a feed
  3. Treat it as low-fidelity and require additional context before building a detection on it Correct answer.
  4. Block the entire cloud range immediately as a permanent control

Explanation

Shared cloud infrastructure is used by many benign and malicious tenants, so an IP from such a range has low specificity and risks high false positives. The hunter should seek corroborating context, such as the URI path, user agent, or process behavior, before relying on it.

Question 26Fundamental concepts of cyber threat analyst and threat hunting

A threat hunting team wants to move beyond simply running searches over logs. Which practice most clearly distinguishes a hunt from routine monitoring?

  1. Raising an alert whenever a signature in the intrusion detection system matches
  2. Reviewing dashboards each morning to confirm that no critical alerts remain open
  3. Starting from a testable hypothesis about adversary behavior and then seeking evidence for or against it Correct answer.
  4. Sending every high-severity alert to the incident response team for triage

Explanation

Threat hunting is a proactive, hypothesis-driven activity in which the analyst formulates a statement about possible adversary behavior and then designs queries against available telemetry to confirm or refute it. Monitoring and alert triage are reactive processes triggered by existing detections, so they do not constitute hunting even when performed diligently.

Question 27Fundamental concepts of cyber threat analyst and threat hunting

Which element is essential when a hunter formalizes a hypothesis before beginning collection and analysis?

  1. A statement that can be proven false by specific observable evidence Correct answer.
  2. A guarantee that the hypothesis will produce at least one confirmed detection
  3. An estimate of how many analysts will be assigned to the hunt
  4. A list of every security tool deployed across the entire organization

Explanation

A useful hunting hypothesis must be falsifiable: it predicts observable behavior so that specific telemetry can either support or refute it. Without that property, the hunt cannot reach a defensible conclusion and risks becoming an open-ended search.

Question 28Fundamental concepts of cyber threat analyst and threat hunting

An analyst is asked to explain why the Pyramid of Pain ranks hash values near the bottom and behavioral techniques near the top. Which reasoning is most accurate?

  1. Behavioral techniques are easier to detect than hashes because they generate more log volume
  2. Hashes require more storage to retain than behavioral descriptions, so they are considered less valuable
  3. Hashes are more precise than behavior, which is why defenders should prioritize them over techniques
  4. Hashes are trivial for an adversary to change, while behavior is costly to alter without disrupting the actor's mission Correct answer.

Explanation

The Pyramid of Pain expresses the cost an adversary bears when a defender detects and blocks a given artifact. A file hash can be changed by a single recompilation, whereas core behavioral tradecraft is tied to the actor's objectives and is expensive to abandon.

Question 29Fundamental concepts of cyber threat analyst and threat hunting

Which statement best describes the purpose of a threat intelligence platform in a hunting program?

  1. It automatically blocks all malicious traffic identified by any connected feed
  2. It guarantees that every indicator in a feed is accurate before ingestion
  3. It replaces the need for endpoint detection by storing indicators centrally
  4. It aggregates, correlates, and enriches intelligence so hunters can query it against their own telemetry Correct answer.

Explanation

A threat intelligence platform centralizes intelligence from multiple sources, normalizes and enriches it, and makes it searchable so analysts can pivot between external reporting and internal telemetry. It supports analysis; it does not validate feed accuracy or enforce blocking on its own.

Question 30Fundamental concepts of cyber threat analyst and threat hunting

A hunter wants to test whether an actor is using living-off-the-land binaries for discovery. Which telemetry source most directly supports this hypothesis?

  1. DHCP lease logs mapping hosts to IP addresses
  2. Email gateway logs recording message delivery status
  3. Process creation events capturing command lines and parent-child relationships on endpoints Correct answer.
  4. Netflow records showing byte counts for outbound connections

Explanation

Living-off-the-land discovery relies on legitimate system utilities, so the decisive evidence is which binary ran, with which arguments, and from which parent process. Process creation telemetry with command-line capture provides exactly that context.

Question 31Fundamental concepts of cyber threat analyst and threat hunting

An analyst finds a domain in a report that is contacted by only one workstation in the estate, and the domain was registered six days ago. Which interpretation is most defensible for hunt follow-up?

  1. The domain should be blocked immediately without further investigation
  2. The domain must be benign because only one host contacted it
  3. The combination of rarity and recency warrants prioritization and pivoting on that host's process and network activity Correct answer.
  4. The finding should be dismissed until the domain appears in a commercial blocklist

Explanation

Newly registered domains contacted by a single host combine two strong risk signals, low prevalence and short age, that justify prioritizing the host for deeper analysis. The correct next step is to pivot into process, DNS, and proxy telemetry to determine what initiated the connection.

Question 32Fundamental concepts of cyber threat analyst and threat hunting

A hunter is selecting ATT&CK techniques to test against a financial services environment. Which prioritization approach best reflects risk-based hunting?

  1. Rank techniques by their observed use against the organization's sector and their potential impact on critical assets Correct answer.
  2. Focus exclusively on the newest techniques published in the framework
  3. Choose only techniques that already have working detections in place
  4. Select techniques alphabetically to ensure complete coverage over time

Explanation

Risk-based hunting weighs the likelihood that an adversary will use a technique against this organization together with the consequence for its critical assets. Sector reporting and asset criticality supply that weighting, so effort goes where exposure is greatest.

Question 33Fundamental concepts of cyber threat analyst and threat hunting

During a hunt, an analyst wants to know whether a suspicious executable has appeared anywhere else in the organization. Which approach best answers that question?

  1. Review the firewall logs for outbound connections from the suspect host
  2. Search a centralized endpoint telemetry repository for the file's hash, name, and execution context across all enrolled hosts Correct answer.
  3. Check the local antivirus console on the suspect host for quarantine events
  4. Request the file's reputation score from a public malware analysis service

Explanation

Establishing estate-wide prevalence requires querying a centralized dataset that covers all enrolled endpoints and includes enough context to distinguish the same file from similarly named ones. Pivoting on hash, name, and execution context in that repository answers the prevalence question directly.

Question 34Fundamental concepts of cyber threat analyst and threat hunting

A hunt concludes that no evidence of the hypothesized technique exists in the collected telemetry. Which interpretation is most rigorous?

  1. The telemetry must be corrupted, since absence of evidence is impossible
  2. The hypothesis is not supported within the scope and coverage of the data examined, and coverage gaps should be documented Correct answer.
  3. The organization is definitively free of that technique and the topic can be closed permanently
  4. The hypothesis was invalid and the hunt should be recorded as a failure

Explanation

A negative result is bounded by what the telemetry actually captured, so the honest conclusion is that the hypothesis was not supported within the examined scope. Documenting coverage limitations preserves the value of the hunt and guides future detection or collection improvements.

Question 35Fundamental concepts of cyber threat analyst and threat hunting

A threat intelligence report describes a new persistence technique but provides no indicators. How should a hunter best use this report?

  1. Add the report's narrative text to the blocklist so enforcement devices can act on it
  2. Wait until a vendor publishes hashes associated with the technique before taking any action
  3. Discard the report because intelligence without indicators cannot support hunting
  4. Translate the described behavior into detection logic and search existing telemetry for evidence of that behavior Correct answer.

Explanation

Technique-level reporting is among the most durable intelligence because it describes behavior rather than disposable artifacts. The hunter converts the described mechanism into queries against existing telemetry, which can reveal use of the technique even when no indicator is available.

Question 36Fundamental concepts of cyber threat analyst and threat hunting

Which statement best captures the relationship between cyber threat intelligence and threat hunting?

  1. Intelligence replaces hunting whenever a feed is comprehensive enough
  2. Hunting exists solely to generate indicators that populate intelligence feeds
  3. Intelligence informs hunt hypotheses and prioritization, while hunting results feed back to refine that intelligence Correct answer.
  4. Intelligence and hunting are independent functions that should not exchange findings

Explanation

The two functions form a loop: intelligence supplies direction about plausible adversary behavior, and hunt findings about what is or is not present in the environment sharpen future intelligence requirements. Treating them as a feedback cycle improves both prioritization and detection coverage.

Question 37Fundamental concepts of cyber threat analyst and threat hunting

A hunter observes that a server initiates an outbound HTTPS session of nearly identical size every 60 seconds to the same external address. Which hypothesis is most productive to test first?

  1. The host is responding to a broadcast storm on the local network
  2. The host is performing routine time synchronization with an internal server
  3. The host is receiving a large software update from a vendor
  4. The host is beaconing to command-and-control infrastructure using a fixed interval and payload profile Correct answer.

Explanation

Highly regular intervals combined with near-constant payload sizes are classic characteristics of automated beaconing, so the most productive first hypothesis concerns command-and-control communication. Testing it means examining process attribution, jitter, destination reputation, and whether the pattern survives host reboots.

Question 38Fundamental concepts of cyber threat analyst and threat hunting

An analyst is evaluating whether an indicator is suitable for durable detection logic. Which property most undermines long-term usefulness?

  1. The indicator is a file hash tied to a single build of a widely redistributed utility Correct answer.
  2. The indicator is a distinctive command-line argument used by a specific tool
  3. The indicator is a registry key path associated with a persistence mechanism
  4. The indicator is a behavioral pattern observed across multiple unrelated campaigns

Explanation

A hash of one build of a commonly redistributed utility will collide with legitimate software and will be invalidated by any recompilation, making it fragile and prone to false positives. Behavioral and structural indicators survive artifact rotation and therefore support more durable detections.

Question 39Fundamental concepts of cyber threat analyst and threat hunting

Two hunters reach different conclusions from the same dataset. Which practice best supports rigorous resolution of the disagreement?

  1. Re-running the queries with documented parameters and reviewing the underlying raw events together Correct answer.
  2. Escalating directly to incident response and closing the hunt
  3. Averaging the two conclusions into a single blended finding
  4. Deferring to the more senior analyst without re-examining the evidence

Explanation

Disagreement usually stems from differing query parameters, time ranges, or interpretation of ambiguous events, so reproducibility is the decisive test. Re-executing documented queries and jointly inspecting raw events isolates whether the divergence is methodological or evidentiary.

Question 40Fundamental concepts of cyber threat analyst and threat hunting

An indicator feed lists an IP address that belongs to a large cloud provider's shared egress range. How should a hunter treat this indicator?

  1. Block the entire range to ensure the malicious activity is contained
  2. Accept the indicator as high fidelity because it came from a commercial feed
  3. Add the IP address to a permanent deny list without expiration
  4. Treat it as low fidelity, since shared infrastructure will generate legitimate traffic, and favor behavioral correlation before any blocking Correct answer.

Explanation

Addresses in shared cloud egress ranges are used by many unrelated tenants, so matching them alone yields high false-positive rates. The sound approach is to treat the indicator as low fidelity and require corroborating behavior, such as unusual process lineage or timing, before considering enforcement.

Question 41Preparation and execution phase of threat hunting programs and incident management plans

When scoping a new threat hunting program, which element most directly defines what the hunt team is authorized to examine and under what legal constraints?

  1. The SIEM vendor's default correlation rules
  2. The number of analysts assigned to the hunt team
  3. The organization's annual penetration test report
  4. The hunt charter and rules of engagement Correct answer.

Explanation

A hunt charter with rules of engagement establishes mandate, scope, data-access permissions, and legal boundaries before any hypothesis is tested. Without this, analysts risk overstepping privacy or legal limits. Other artifacts inform hunts but do not authorize them.

Question 42Preparation and execution phase of threat hunting programs and incident management plans

A threat hunting team is drafting hypotheses. Which hypothesis formulation is most actionable for a hunt?

  1. Threat actors are likely targeting our industry
  2. The organization might be at risk from advanced threats
  3. Attackers may be somewhere in the network doing something bad
  4. Adversaries using valid accounts may perform lateral SMB connections outside normal peer-group patterns Correct answer.

Explanation

A hunt hypothesis must be testable and tied to observable telemetry, specifying actor behavior, expected evidence, and a measurable baseline. Vague risk statements cannot be validated or falsified by data. The SMB peer-group statement defines what evidence would confirm or refute it.

Question 43Preparation and execution phase of threat hunting programs and incident management plans

During hunt execution, what is the primary purpose of establishing a baseline of normal activity?

  1. To reduce the cost of endpoint agents
  2. To satisfy audit logging retention requirements
  3. To replace the need for threat intelligence feeds
  4. To identify deviations that may indicate adversary behavior Correct answer.

Explanation

Baselines describe expected patterns so analysts can spot anomalies that warrant investigation. They support deviation analysis rather than replacing intelligence or meeting retention rules. Hunts compare observed behavior against this baseline.

Question 44Preparation and execution phase of threat hunting programs and incident management plans

Which data source is most appropriate for hunting adversary use of living-off-the-land binaries executing suspicious command-line arguments on endpoints?

  1. NetFlow records aggregated at the perimeter
  2. Endpoint process creation telemetry with command-line capture Correct answer.
  3. Firewall deny logs
  4. DNS query logs from the recursive resolver

Explanation

Command-line execution of native binaries is visible in endpoint process telemetry that records parent-child relationships and arguments. NetFlow, DNS, and firewall logs lack process context. Selecting the right data source is a core execution-phase decision.

Question 45Preparation and execution phase of threat hunting programs and incident management plans

In an incident management plan, what distinguishes the preparation phase from the detection and response phases?

  1. Preparation is performed exclusively by external counsel
  2. Preparation only applies after an incident is contained
  3. Preparation builds capabilities, roles, and procedures before incidents occur Correct answer.
  4. Preparation replaces the need for post-incident review

Explanation

The preparation phase establishes plans, roles, playbooks, tooling, and training in advance of incidents. Detection and response phases activate those capabilities. Preparation is not reactive and does not eliminate lessons-learned reviews.

Question 46Preparation and execution phase of threat hunting programs and incident management plans

Which artifact best documents who is authorized to declare a major security incident and who must be notified?

  1. An incident response escalation matrix with defined thresholds Correct answer.
  2. A change advisory board calendar
  3. A vulnerability scan report
  4. A threat intelligence platform subscription list

Explanation

An escalation matrix maps incident severity thresholds to declaration authority and notification paths. It removes ambiguity during high-pressure events. The other artifacts serve different functions and do not define escalation authority.

Question 47Preparation and execution phase of threat hunting programs and incident management plans

A hunt hypothesis is disproven after thorough data review. What is the most valuable next step in the hunt lifecycle?

  1. Escalate to incident response as if a compromise occurred
  2. Delete the hypothesis and related data to save storage
  3. Document the negative result and any detection gaps identified Correct answer.
  4. Immediately repeat the same hunt with identical parameters

Explanation

Documenting disproven hypotheses and any uncovered visibility or detection gaps preserves institutional knowledge and improves future hunts. Negative results are legitimate outcomes. Repeating identical parameters without change adds little value.

Question 48Preparation and execution phase of threat hunting programs and incident management plans

Which metric best indicates whether a threat hunting program is generating operational value rather than only activity?

  1. Total analyst hours spent in the SIEM
  2. Number of threat intelligence feeds subscribed to
  3. Count of hunts that produced validated findings leading to detection improvements Correct answer.
  4. Number of raw log events ingested per day

Explanation

Program value is shown by hunts producing validated findings and concrete detection or control improvements. Volume metrics like log counts or hours measure effort, not outcomes. This distinction guides program maturity assessment.

Question 49Preparation and execution phase of threat hunting programs and incident management plans

A hunt analyst observes a workstation making periodic outbound HTTPS connections to a newly registered domain at fixed 60-second intervals. Which analytic technique best supports triage of this finding?

  1. Checking the printer queue for stalled jobs
  2. Comparing connection periodicity and destination age against known-good software update patterns Correct answer.
  3. Disabling the workstation's network adapter immediately
  4. Reviewing the workstation's warranty status

Explanation

Beacon-like periodicity to newly registered infrastructure warrants comparison against legitimate update or telemetry patterns before escalation. This contextual comparison distinguishes malicious beaconing from benign scheduled traffic. Disruptive actions require stronger evidence first.

Question 50Preparation and execution phase of threat hunting programs and incident management plans

Which practice best ensures hunt findings are converted into durable detection capability?

  1. Restricting findings to the original hunt analyst
  2. Archiving hunt reports in a shared drive without further action
  3. Translating validated findings into detection rules, tuning, and monitoring use cases Correct answer.
  4. Closing the hunt ticket as soon as data collection ends

Explanation

Hunts create lasting value when validated behaviors become detection logic, tuned analytics, or monitoring use cases. This feedback loop operationalizes findings. Passive archiving or restricting knowledge prevents that transition.