MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

Threat hunting in cybersecurity primarily aims to identify which of the following?
a. Unknown threats within an organization’s network
b. Outdated password policies
c. Software licensing issues
d. Hardware degradation
Answer: a. Unknown threats within an organization’s networkheimdalsecurity+2
Which of the following best describes threat hunting?
a. Passive observation of network traffic
b. Proactive search for security breaches or anomalies
c. Random data scanning for patterns
d. Updating antivirus definitions only
Answer: b. Proactive search for security breaches or anomaliesbitlyft+2
Which framework is most commonly used for structuring cyber threat hunts?
a. OWASP Top 10
b. MITRE ATT&CK
c. ISO 27001
d. NIST 800-53
Answer: b. MITRE ATT&CKhunt+2
What are the three main types of threat hunting methodologies?
a. Hypothesis-based, intelligence-based, and custom-hunting
b. Manual, AI-driven, and automated
c. Preventive, reactive, and adaptive
d. Strategic, tactical, and operational
Answer: a. Hypothesis-based, intelligence-based, and custom-huntingheimdalsecurity+1
Which type of hunt is usually triggered by Indicators of Compromise (IoCs)?
a. Hypothesis-driven
b. Intelligence-based
c. Custom-hunting
d. Predictive-hunting
Answer: b. Intelligence-basedbitlyft+1
The PEAK framework stands for:
a. Prepare, Execute, and Act with Knowledge
b. Predict, Evaluate, Assess, and Keep
c. Prepare, Engage, Audit, and Know
d. Plan, Execute, and Keep logs
Answer: a. Prepare, Execute, and Act with Knowledgecycognito+1
Which organization developed the PEAK threat hunting framework?
a. Cisco
b. Splunk
c. CrowdStrike
d. Palo Alto Networks
Answer: b. Splunkrapid7+1
What is the first stage of any threat hunting process?
a. Investigation
b. Resolution
c. Hypothesis development or trigger
d. Data export
Answer: c. Hypothesis development or triggercrowdstrike+2
In a typical hunt process, what follows the investigation stage?
a. Reporting
b. Resolution and mitigation
c. Data deletion
d. Containment
Answer: b. Resolution and mitigationcrowdstrike+1
Intel-based threat hunting relies heavily on which components?
a. Firewall rules
b. Indicators of Compromise (IoCs)
c. Social media analytics
d. Policy configurations
Answer: b. Indicators of Compromise (IoCs)rapid7+2
What is the goal of hypothesis-based threat hunting?
a. To confirm known threats
b. To investigate suspected attacker behaviors based on assumptions
c. To analyze network bandwidth
d. To ensure compliance
Answer: b. To investigate suspected attacker behaviors based on assumptionsheimdalsecurity+1
What does IoA stand for in threat hunting?
a. Indicators of Anomaly
b. Indicators of Attack
c. Integrity of Access
d. Indicators of Authorization
Answer: b. Indicators of Attackbitlyft+1
What is the main difference between reactive and proactive defense approaches?
a. Reactive waits for alerts, proactive hunts before alerts
b. Reactive is cheaper, proactive is costly
c. Reactive is manual, proactive is automated
d. Reactive uses AI models
Answer: a. Reactive waits for alerts, proactive hunts before alertsfortinet+2
Structured hunting is usually based on which established frameworks?
a. Intrusion Kill Chain or MITRE ATT&CK
b. ISO 31000
c. COBIT
d. GDPR
Answer: a. Intrusion Kill Chain or MITRE ATT&CKhunt+1
Which of the following represents a proactive hunting activity?
a. Deploying patches monthly
b. Investigating anomalies without alerts
c. Waiting for SIEM alerts
d. Scheduling yearly audits
Answer: b. Investigating anomalies without alertscybereason+2
What type of data is used most heavily in threat hunting?
a. System logs and network telemetry
b. Spreadsheets
c. Website cookies
d. Software manuals
Answer: a. System logs and network telemetryfortinet+2
Which tool category supports advanced hunting in endpoint environments?
a. EDR tools
b. CRM systems
c. ERP databases
d. Office automation tools
Answer: a. EDR toolsstationx+2
What is the main objective of a threat hunting hypothesis?
a. To make assumptions based on emerging threat patterns
b. To test hardware resilience
c. To identify staff performance issues
d. To reduce compliance overhead
Answer: a. To make assumptions based on emerging threat patternsheimdalsecurity+1
Which framework breaks down adversary behavior into tactics and techniques?
a. MITRE ATT&CK
b. ISO 27005
c. FAIR
d. SOC 2
Answer: a. MITRE ATT&CKhunt+1
The Open Threat Hunting Framework (OTHF) is known for promoting what?
a. Open collaboration and repeatable hunting models
b. Proprietary analytics
c. Confidentiality enforcement
d. Vendor-specific integrations only
Answer: a. Open collaboration and repeatable hunting modelsrapid7+1
Bitsight’s 5-Step Framework emphasizes what?
a. Hypothesis-driven and intelligence-prioritized hunting
b. Restricting threat intelligence sharing
c. Automated patch scheduling
d. Log retention policies
Answer: a. Hypothesis-driven and intelligence-prioritized huntinghunt+1
Which of these steps closes the threat hunting loop?
a. Documentation and communication of findings
b. Asset inventory updates
c. Email monitoring
d. License reviews
Answer: a. Documentation and communication of findingscrowdstrike+1
What is a ‘trigger’ in threat hunting?
a. An event or indicator initiating the hunt
b. An alert suppression rule
c. A network attack simulation
d. A SIEM license renewal
Answer: a. An event or indicator initiating the huntbitlyft+2
The hypothesis phase often uses what to define the hunt’s objective?
a. TTPs—Tactics, Techniques, and Procedures
b. GDPR guidelines
c. Firewall ACLs
d. OS security baselines
Answer: a. TTPs—Tactics, Techniques, and Proceduresheimdalsecurity+2
Which component of a SIEM supports hunting activities the most?
a. Log correlation engine
b. License validation module
c. Email notification tool
d. Resource monitor
Answer: a. Log correlation enginestationx+2
Threat hunters typically assume that adversaries:
a. Are already inside the system
b. Are outside the protected perimeter
c. Cannot bypass firewalls
d. Only attack during work hours
Answer: a. Are already inside the systemcrowdstrike+2
What key skill distinguishes a threat hunter from traditional analysts?
a. Proactive hypothesis formation and manual investigation
b. Reliance on automated alerts
c. Policy documentation
d. Network hardware setup
Answer: a. Proactive hypothesis formation and manual investigationcybereason+2
Which of these is a primary benefit of proactive threat hunting?
a. Reduces dwell time of hidden threats
b. Simplifies compliance only
c. Improves marketing analytics
d. Reduces software costs
Answer: a. Reduces dwell time of hidden threatscrowdstrike+2
Which type of analytics enhances advanced threat hunting?
a. Behavioral analytics
b. Sales analytics
c. Payroll analytics
d. Visualization analytics
Answer: a. Behavioral analyticsrapid7+1
What is the purpose of documenting threat hunts?
a. To build institutional knowledge and prevent repetition
b. To meet financial reporting needs
c. To justify software costs
d. To prepare employee evaluations
Answer: a. To build institutional knowledge and prevent repetitionbitlyft+1
Which hunting process leverages both IoA and IoC data?
a. Custom/Situational hunting
b. Reactive hunting
c. Passive monitoring
d. Defensive testing
Answer: a. Custom/Situational huntingheimdalsecurity+1
What is the function of post-hunt intelligence sharing?
a. Improves collaboration between teams
b. Decreases SOC visibility
c. Reduces analytic logs
d. Delays mitigation
Answer: a. Improves collaboration between teamsfortinet+1
What type of threat detection often complements hunting?
a. Automated detection by SIEM and EDR tools
b. Manual log review
c. Social engineering
d. VPN connection monitoring
Answer: a. Automated detection by SIEM and EDR toolsstationx+1
Which type of cyber threat is most effectively found through hunting?
a. Advanced Persistent Threats (APTs)
b. Spam email
c. URL misconfigurations
d. DNS caching
Answer: a. Advanced Persistent Threats (APTs)cybereason+2
What role does machine learning play in modern threat hunting?
a. Pattern recognition and anomaly detection
b. UI automation
c. Data encryption
d. Schema validation
Answer: a. Pattern recognition and anomaly detectionstationx+2
What’s a major limitation of automated detection tools?
a. They miss hidden or unknown threats
b. They create no false positives
c. They replace human analysts fully
d. They cannot be tuned
Answer: a. They miss hidden or unknown threatsrapid7+1
Which step in the hunting process directly mitigates identified threats?
a. Response and resolution
b. Hypothesis summary
c. Metrics reporting
d. Alert tuning
Answer: a. Response and resolutioncrowdstrike+1
What is required to build effective hunting hypotheses?
a. Threat intelligence and historical attack data
b. User activity logs only
c. VPN traffic
d. Employee attendance
Answer: a. Threat intelligence and historical attack datahunt+2
What type of data visualization supports faster hunting decisions?
a. Real-time dashboards in SIEM
b. Email charts
c. Spreadsheet macros
d. Compliance summaries
Answer: a. Real-time dashboards in SIEMstationx+1
CrowdStrike identifies three key steps in hunting as:
a. Trigger, investigation, resolution
b. Alert, report, patch
c. Detection, encryption, escalation
d. Review, filter, classify
Answer: a. Trigger, investigation, resolutioncrowdstrike
What is the principal aim of continuous threat hunting?
a. Enhancing resilience through ongoing analysis
b. Reducing patch frequency
c. Increasing cloud costs
d. Limiting firewall rules
Answer: a. Enhancing resilience through ongoing analysisbitlyft+2
Which EDR tool is widely recognized for proactive hunting?
a. CrowdStrike Falcon
b. Microsoft Excel
c. Wireshark
d. PuTTY
Answer: a. CrowdStrike Falconrapid7+1
An advanced hunting platform often integrates data from:
a. Multiple sources including SIEM, EDR, and threat intelligence feeds
b. Only HR databases
c. Only web analytics tools
d. None of the above
Answer: a. Multiple sources including SIEM, EDR, and threat intelligence feedsstationx+1
What defines a “hunt maturity model”?
a. Organizational progression in proactive hunting capabilities
b. Hardware upgrade plan
c. Network design guide
d. Compliance checklist
Answer: a. Organizational progression in proactive hunting capabilitiesbitlyft+1
In the MITRE ATT&CK matrix, what do tactics represent?
a. The “why” or the adversary’s objective
b. The “how” of the attack
c. The “where” of compromise
d. The victim’s location
Answer: a. The “why” or the adversary’s objectivehunt+1
Which hunting source is most helpful for understanding target patterns?
a. Threat intelligence reports
b. Social media posts
c. Printer logs
d. Audio data
Answer: a. Threat intelligence reportsheimdalsecurity+2
Which process in threat hunting helps validate tool alerts?
a. Manual correlation and hypothesis testing
b. Automatic whitelist creation
c. Network segmentation
d. Data compression
Answer: a. Manual correlation and hypothesis testingrapid7+1
What metric measures the success of hunting activities?
a. Mean Time to Detect (MTTD)
b. Load balancing ratio
c. Server uptime
d. Storage latency
Answer: a. Mean Time to Detect (MTTD)stationx+1
Why is collaboration between SOC analysts and hunters essential?
a. To ensure detection rules evolve with discovered threats
b. To reduce hardware licensing costs
c. To manage cloud resources
d. To avoid redundancy
Answer: a. To ensure detection rules evolve with discovered threatsbitlyft+1
What long-term benefit does systematic threat hunting provide?
a. Strengthened organization-wide cyber resilience
b. Lower hardware usage
c. Simplified payroll tracking
d. Customer support optimization
Answer: a. Strengthened organization-wide cyber resiliencefortinet+2

Blog

Systemethic Technologies

Leave a Reply Cancel reply

Useful links

Other Terms & Policies

Contact Info