How should I use these Threat Hunting And Detection practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Threat Hunting And Detection questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Threat Hunting And Detection domain.

312-85 · topic practice

Threat Hunting And Detection practice questions

Practise Certified Threat Intelligence Analyst (312-85) Threat Hunting And Detection practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Threat Hunting And Detection

Practice 10 questions Browse domain →

What the exam tests

What to know about Threat Hunting And Detection

Threat Hunting And Detection questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Threat Hunting And Detection exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Threat Hunting And Detection questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Threat Hunting And Detection explanation →

When conducting a hunt for lateral movement using MITRE ATT&CK T1021.001 (Remote Desktop Protocol), which log source is most effective for detecting anomalous RDP connections?

Trap 1: System Event ID 7045

7045 is for service installation.

Trap 2: Security Event ID 1102

1102 tracks audit log clearance.

Trap 3: Security Event ID 4624

4624 shows logins but does not distinguish RDP session details specifically enough for lateral movement hunting.

Study all Threat Hunting And Detection common traps →

A
System Event ID 7045
Why wrong: 7045 is for service installation.
B
Microsoft-Windows-TerminalServices-LocalSessionManager/Operational Event ID 21
This log tracks successful session reconnections, a key indicator of RDP-based lateral movement.
C
Security Event ID 1102
Why wrong: 1102 tracks audit log clearance.
D
Security Event ID 4624
Why wrong: 4624 shows logins but does not distinguish RDP session details specifically enough for lateral movement hunting.

Threat Hunting And Detection practice questions

What to know about Threat Hunting And Detection

Common Threat Hunting And Detection exam traps

Threat Hunting And Detection questions

When conducting a hunt for lateral movement using MITRE ATT&CK T1021.001 (Remote Desktop Protocol), which log source is most effective for detecting anomalous RDP connections?

While hunting for hidden network traffic, you identify anomalous 'Beacon' activity in the proxy logs. Which metric is the most effective way to filter out normal traffic noise?

When hunting for credential dumping using Mimikatz, which process memory access pattern is the most common indicator?

A threat hunter wants to identify unauthorized DNS tunneling. Which data point is most indicative of this activity?

You are hunting for Cobalt Strike C2 using JA3/JA3S fingerprinting. If the JA3S value is unique for your environment and observed across multiple hosts, what does this suggest?

An analyst is investigating potential persistence via WMI event subscriptions. Which WMI namespace should the hunter focus on for suspicious event consumers?

A threat hunter is using Sysmon to identify potential process hollowing. Which Event ID should the analyst prioritize in their hunting query?

During an investigation, you observe suspicious PowerShell execution with the -EncodedCommand flag. Which log provider should you consult to see the decoded script block content?

While using ELK Stack for threat hunting, you need to identify beaconing behavior. Which aggregation function would best reveal periodicity in connection intervals?

You are hunting for unauthorized scheduled tasks. Which PowerShell cmdlet allows you to audit these tasks remotely across the enterprise?

Which hunting methodology involves starting with a known adversary tactic and working backward to identify evidence in your logs?

When hunting for malicious DLL side-loading, which file property is most critical to verify?

While hunting for living-off-the-land (LotL) binaries, you identify suspicious use of 'certutil.exe'. What is the most likely malicious purpose for this utility?

Which tool is most effective for visualizing the parent-child process relationships during a threat hunt?

A hunt for unusual Kerberos activity reveals an 'AS-REP Roasting' attack. What specific event indicator should the analyst look for in domain controller logs?

An analyst is hunting for unauthorized network connections. Which port is commonly associated with SMB, frequently used for lateral movement (e.g., PSExec)?

When conducting a hunt for 'Golden Ticket' attacks, which attribute should be checked for anomalies in the Kerberos ticket?

Which TWO log sources are most essential when hunting for adversary use of living-off-the-land binaries (LotL)?

Which TWO artifacts are most important when investigating a possible 'Fileless Malware' infection?

Which THREE techniques are commonly associated with the 'Execution' phase of the MITRE ATT&CK framework and should be prioritized in a threat hunt?

Track your progress over time

Start a Threat Hunting And Detection only practice session

Related 312-85 topic practice pages

Data Analysis practice questions

Intelligence Reporting And Dissemination practice questions

Data Collection And Processing practice questions

Cyber Threats And Attack Frameworks practice questions

Introduction TO Threat Intelligence practice questions

Threat Hunting And Detection practice questions

Threat Intelligence IN SOC IR And Risk Management practice questions

Requirements Planning Direction And Review practice questions

312-85 fundamentals practice questions

312-85 scenario practice questions

312-85 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid