312-85 › Threat Hunting And Detection
This domain covers proactive threat hunting and detection engineering: forming hypotheses, querying telemetry, and validating findings. Questions present realistic artifacts—Zeek conn.log and DNS logs, Windows Security events, WMI persistence—and ask which data source, namespace, or indicator to pivot on. Expect scenario-based items requiring you to interpret evidence and select the correct investigative step.
312-85 Threat Hunting And Detection — All 47 Questions
Every question in this domain with answers and detailed explanations.