312-85 Threat Hunting And Detection Practice Test 2 — 15 Questions

Question 1

You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?

Accepted Answer

Get-ScheduledTask. Get-ScheduledTask is the PowerShell cmdlet that retrieves scheduled tasks from the local or remote computer. It allows auditors and threat hunters to enumerate scheduled tasks across the enterprise, which is critical for detecting persistence mechanisms. It can be combined with Invoke-Command or CIM sessions for remote auditing.

Answer

Get-Service

Answer

Get-Process

Answer

Get-WmiObject Win32_StartupCommand

Question 2

Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a specific, testable proposition about adversary behavior — typically derived from a known TTP, threat intel report, or ATT&CK technique — and then searches telemetry for evidence that confirms or refutes it. Because the hypothesis is anchored to a known adversary tactic, the analyst works backward from the tactic to the artifacts it would leave in logs (e.g., process creation, registry writes, network connections). This structured, deductive approach is the defining characteristic of hypothesis-driven threat hunting.

Answer

Incident response forensics

Answer

Machine learning-based hunting

Answer

Alert-driven hunting

Question 3

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

Accepted Answer

Downloading remote payloads. certutil.exe is a legitimate Windows utility for managing certificates, but attackers abuse its -urlcache and -split flags to download files from remote URLs, effectively turning it into a LOLBin downloader. This allows payload retrieval without introducing custom malware, evading application whitelisting.

Answer

Extracting browser passwords

Answer

Clearing event logs

Answer

Modifying system registry keys

Question 4

Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?

Accepted Answer

Process Explorer. Process Explorer is the Sysinternals tool that displays a hierarchical tree of processes showing parent-child relationships, which is exactly what is needed to visualize how processes spawned during a threat hunt. It shows the process tree, command lines, and parent PIDs, making it ideal for spotting suspicious process ancestry like a Word document spawning PowerShell. This directly supports identifying malicious process chains.

Answer

Resource Monitor

Answer

PowerShell ISE

Answer

Wireshark

Question 5

A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?

Accepted Answer

Event ID 4768 with pre-auth not required. AS-REP Roasting targets accounts configured with 'Do not require Kerberos preauthentication.' When pre-auth is disabled, an attacker can send an AS-REQ without proving identity, and the domain controller responds with an AS-REP containing a ticket encrypted with the user's password hash — which the attacker can crack offline. The corresponding DC event is Event ID 4768 (Kerberos authentication ticket TGT requested), and the key indicator is the pre-authentication type field showing that pre-auth was not required.

Answer

Event ID 4771

Answer

Event ID 4624

Answer

Event ID 4769

Question 6

An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?

Accepted Answer

Port 445. Port 445 is the standard TCP port for SMB (Server Message Block) over TCP, used for file sharing, named pipes, and remote administration. Attackers commonly abuse SMB via tools like PSExec, which uses SMB to copy and execute binaries on remote hosts, making port 445 a primary vector for lateral movement and ransomware propagation (e.g., WannaCry, NotPetya).

Answer

Port 80

Answer

Port 3389

Answer

Port 22

Question 7

Which TWO log sources are most essential when hunting for adversary use of living-off-the-land binaries (LotL)?

Accepted Answer

Sysmon Event ID 1. Sysmon Event ID 1 (Process Create) is essential because it captures detailed process creation telemetry including the full command line, parent process, image path, hashes, and user context, which is exactly what is needed to spot legitimate Windows binaries like powershell.exe, rundll32.exe, or certutil.exe being abused for LotL activity. Security Event ID 4688 (A New Process Has Been Created) is also essential because it records process creation with the new process name, creator process, and — when command-line auditing is enabled — the full command line, providing native Windows visibility into LotL binary execution even without Sysmon deployed. Together these two process-creation sources give the command-line and parent-child process context that LotL hunting fundamentally depends on. System Event Log Event ID 7045 only shows service installation and would miss the vast majority of LotL execution that does not install a service. DHCP Server logs only record IP lease assignments and offer no process or command-line visibility. DNS Query logs can reveal malicious domains but do not show which binary or command line made the query, so they are supporting rather than essential for identifying LotL binary abuse.

Answer

System Event Log (Event ID 7045)

Answer

DHCP Server logs

Answer

DNS Query logs

Question 8

Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?

Accepted Answer

PowerShell Script Block Logging. PowerShell Script Block Logging (Option A) is critical because fileless malware frequently executes malicious code through PowerShell without writing a payload to disk, and Script Block Logging (Event ID 4104) captures the full de-obfuscated script content that defenders need for detection and analysis. WMI Repository contents (Option B) are equally important because fileless attacks commonly abuse WMI for persistence and execution via event subscriptions and __EventFilter/CommandLineEventConsumer classes stored in the repository, which leaves no traditional executable on disk. In contrast, File System MFT records (Option C) mainly track file creation and metadata, which is largely irrelevant when the attack avoids dropping files, and Browser Cache History (Option D) only reflects web browsing artifacts unrelated to in-memory or WMI-based execution. Windows Update logs (Option E) record patching activity and have no bearing on detecting fileless malware techniques.

Answer

File System MFT records

Answer

Browser Cache History

Answer

Windows Update logs

Question 9

When hunting for lateral movement, which THREE activities should be flagged as highly suspicious in a Windows environment?

Accepted Answer

Remote RDP access to a Domain Controller. Option A is correct because interactive RDP logons to a Domain Controller are highly unusual in normal operations — DCs are administered via RSAT, WinRM, or console access, so a Type 10 logon (Event ID 4624) to a DC often indicates credential abuse or lateral movement toward the highest-value target. Option C is correct because WMI is a legitimate remote management mechanism, but services.exe (or its child processes) being spawned via WMI (e.g., Win32_Process Create) is a classic lateral-movement and execution technique used by tools like Impacket's wmiexec and Cobalt Strike, since it lets an attacker run code remotely without dropping a binary to disk. Option E is correct because creating a service remotely with sc.exe (or PsExec-style service creation) is a well-known lateral-movement and persistence method — it requires admin rights on the target and results in Event ID 7045 (a new service was installed) plus 4697, making it a strong indicator of compromise. Option B is not suspicious because opening a local text file is a routine user action with no lateral-movement significance. Option D is not suspicious because 'whoami' is a benign built-in command that standard users and administrators run constantly for troubleshooting, and it does not by itself indicate movement across hosts.

Answer

Opening a local text file

Answer

Standard user running 'whoami'

Question 10

Which TWO file integrity monitoring (FIM) events would be most useful to detect potential unauthorized persistence mechanisms?

Accepted Answer

Creation of files in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp. Option A is correct because the StartUp folder at C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp is a well-known autostart location, and creation of files there can indicate an attacker establishing persistence that executes at user logon. Option C is correct because the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry key is a classic persistence mechanism, and its modification can reveal malicious programs configured to launch automatically at system startup. Option B is not correct because merely accessing the hosts file is not a persistence event, although unauthorized modification of it could be suspicious. Option D is not correct because desktop background changes are cosmetic and not a recognized persistence technique. Option E is not correct because reading browser profile files may indicate credential theft or reconnaissance, but it does not itself establish persistence.

Answer

Access to C:\Windows\System32\drivers\etc\hosts

Answer

Changes to desktop background images

Answer

Reading of browser profile files

Question 11

Which THREE indicators are strong evidence of a 'Pass-the-Hash' attack occurring in your network?

Accepted Answer

Logon Type 3 occurring from a workstation to a workstation. Option A is correct because Pass-the-Hash (PtH) abuses NTLM authentication to move laterally, and a Logon Type 3 (network logon) from one workstation to another is abnormal in most environments and is a classic signature of PtH lateral movement using stolen NTLM hashes. Option B is correct because a successful logon originating from an unexpected or unusual source IP indicates an attacker is authenticating with compromised credentials/hashes from a host that should not be initiating such access, which is a strong PtH indicator. Option D is correct because PtH relies on NTLM authentication (the hash is replayed directly), so observing NTLM authentication where Kerberos would normally be expected (e.g., in a domain environment that supports Kerberos) is a strong indicator of hash-based authentication abuse. Option C is not a PtH indicator because successful local service startup is normal system behavior and unrelated to credential theft or replay. Option E is not a PtH indicator because a high volume of Kerberos TGS requests suggests Kerberos ticket activity (e.g., Kerberoasting or normal service ticket requests), not NTLM hash replay.

Answer

Success of local service startup

Answer

High volume of Kerberos TGS requests

Question 12

Which TWO command-line parameters are highly suspicious when observed with 'powershell.exe' in your telemetry?

Accepted Answer

-WindowStyle Hidden. Option A, -WindowStyle Hidden, is highly suspicious because it deliberately conceals the PowerShell console window from the user, a common technique in malware and post-exploitation frameworks to hide malicious activity from the victim. Option B, -EncodedCommand, is highly suspicious because it accepts a Base64-encoded command string, which attackers use to obfuscate payloads and evade simple string-based detection in command-line telemetry. In contrast, -File (C) is a normal parameter for executing a script file and is routinely used in legitimate administration, -InputFormat (D) merely specifies the input format (e.g., XML or text) for commands and is benign, and -Version (E) only selects which PowerShell engine version to run and carries no inherent malicious intent.

Answer

-File

Answer

-InputFormat

Answer

-Version

Question 13

A threat hunter is reviewing Sysmon logs to detect potential credential dumping via LSASS memory access. Which Sysmon Event ID should the hunter prioritize to identify suspicious access to the lsass.exe process?

Accepted Answer

Event ID 10 (ProcessAccess). Sysmon Event ID 10 (ProcessAccess) captures detailed information about processes opening handles to other processes, including the target lsass.exe and the requested access rights. Credential dumping tools like Mimikatz typically request access rights such as 0x1010 or 0x1410 to read LSASS memory. By monitoring Event ID 10 for suspicious access to lsass.exe, hunters can detect credential dumping attempts in real time.

Answer

Event ID 7 (Image Loaded)

Answer

Event ID 1 (Process Creation)

Answer

Event ID 8 (CreateRemoteThread)

Question 14

A threat hunter reviewing Windows Security event logs notices that a service account's credentials were used to authenticate to 14 workstations within a 3-minute window, all successful logons with Logon Type 3. No scheduled tasks or administrative scripts are known to run under this account. Which hypothesis best explains this pattern and should drive the next hunt step?

Accepted Answer

The account is being used for lateral movement via SMB or remote service execution, and the hunter should pivot to Event ID 5140/5145 and service creation telemetry on the target hosts.. A burst of successful Logon Type 3 authentications from one service account across many workstations is a strong lateral movement indicator. Attackers using SMB, remote service creation, or remote execution tools generate exactly this footprint. The productive next step is to pivot to the destination hosts and examine share access, service installation, and process creation events to determine what was executed after authentication.

Answer

The account is being brute-forced by an external attacker, and the hunter should immediately review Event ID 4625 failures on the domain controller.

Answer

The workstations are performing a scheduled vulnerability scan using domain credentials, and the hunter should correlate with the scanner's IP range before escalating.

Answer

The account is experiencing a Kerberos ticket renewal storm, and the hunter should analyze Event ID 4769 service ticket requests on the KDC.

Question 15

A hunter is investigating anomalous DNS activity on an internal resolver. Several endpoints are issuing high volumes of queries for long, random-looking subdomains under a single registered domain, with responses that are mostly NXDOMAIN but occasionally resolve. Which TWO detection approaches would most effectively confirm whether this is DNS tunneling or domain generation algorithm activity? (Choose two.)

Accepted Answer

Correlate the timing and volume of queries with the process that initiated them using endpoint DNS client event telemetry.. Confirming DNS tunneling or DGA activity requires both statistical characterization of the query names and attribution to the originating process. Measuring query length and entropy against a per-endpoint baseline exposes algorithmically generated or encoded names, while endpoint DNS client telemetry ties those queries to the specific binary responsible. Together these methods produce defensible evidence rather than relying on blocklists.

Answer

Review the resolver's cache hit ratio and increase the TTL on all cached records to reduce query volume.

Answer

Search the SIEM for the registered domain across historical proxy logs and add it to a watchlist if it appears in any HTTP request.

Answer

Block all outbound DNS at the perimeter and force every endpoint to use DNS over HTTPS to a public resolver.