Threat hunting techniques in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Threat Hunting Hypotheses

Which of the following best describes the role of a hypothesis in threat hunting?

A A guess made without any data to start the investigation

B A final conclusion after completing the threat hunt

C A testable statement based on observed data to guide the hunt

D A list of all known malware signatures used in detection

💡 Hint

Think about how hunters decide what to look for before searching.

A hypothesis in threat hunting is a testable statement formed from observed data or intelligence. It guides the investigation by focusing on what to look for.

📋 Factual

intermediate

Common Data Sources in Threat Hunting

Which data source is most commonly used for detecting lateral movement within a network during threat hunting?

A Endpoint process execution logs

B DNS query logs

C Firewall traffic logs

D Email spam filters

💡 Hint

Consider where you can see what programs are running on computers.

Endpoint process execution logs show what programs run on devices and can reveal suspicious lateral movement activities.

🔍 Analysis

advanced

Analyzing Threat Hunting Techniques

Which technique is best suited for discovering unknown threats that do not match existing signatures?

A Anomaly detection using baselines

B Signature-based detection

C Using antivirus software scans

D Blocking known malicious IP addresses

💡 Hint

Think about how to find threats that look different from normal behavior.

Anomaly detection compares current behavior to a baseline of normal activity to find unusual patterns, helping discover unknown threats.

❓ Comparison

advanced

Comparing Threat Hunting Approaches

Which statement correctly compares proactive and reactive threat hunting?

A Proactive hunting waits for alerts before investigating; reactive hunting searches without alerts.

B Reactive hunting ignores alerts and focuses on random data analysis.

C Both proactive and reactive hunting only respond after a breach is confirmed.

D Proactive hunting uses hypotheses to search for threats before alerts; reactive hunting investigates after alerts.

💡 Hint

Consider when each hunting approach starts the investigation.

Proactive hunting starts with hypotheses and searches for threats before alerts occur. Reactive hunting investigates after alerts or incidents.

❓ Reasoning

expert

Evaluating Threat Hunting Outcomes

After conducting a threat hunt, a team finds no evidence of compromise but notices unusual spikes in network traffic at odd hours. What is the best next step?

A Ignore the spikes as false positives since no compromise was found.

B Investigate the unusual traffic further to understand its cause.

C Conclude the environment is safe and end the hunt immediately.

D Delete all logs to prevent confusion in future hunts.

💡 Hint

Think about how to handle suspicious but unclear findings.

Unusual traffic spikes may indicate hidden threats or misconfigurations. Investigating further helps ensure no threats are missed.