CCNA Threat Hunting Questions

MCQeasy

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

A.Threat Intelligence Source List

B.Hunt Procedure and Query Logic

C.Executive Summary

D.Hardware Requirements

AnswerB

Clear steps and query logic ensure the hunt can be audited and repeated.

Why this answer

A documented 'Procedure' or 'Steps' section ensures that the methodology is clear and can be executed consistently by others.

Practice this question →

MCQeasy

Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?

A.Data Preparation

B.Reporting

C.Hunt Execution

D.Hypothesis Generation

AnswerD

This is the starting phase where the hunt focus is established.

Why this answer

The 'Hypothesis Generation' phase involves determining what to hunt for based on threat intelligence or environmental observations.

Practice this question →

MCQhard

You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?

A.search dest_ip=x.x.x.x | rare dest_ip

B.search dest_ip=x.x.x.x | streamstats current=f window=2 global=f last(_time) as prev_time | eval diff=_time - prev_time

C.search dest_ip=x.x.x.x | timechart span=1h count

D.search dest_ip=x.x.x.x | stats count by _time

AnswerB

Calculating the time difference between consecutive events is the standard method for finding periodic beaconing.

Why this answer

The streamstats command allows for calculating intervals between events, which is critical for identifying beaconing patterns in network traffic.

Practice this question →

Multi-Selectmedium

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

Select 2 answers

A.The budget for the security department

B.A copy of the company's network topology map

C.Detailed SPL search queries

D.A list of all employees in the company

E.Incident response escalation steps

AnswersC, E

The query is the core tool of the hunt.

Why this answer

Actionable hunts require clear search queries and defined 'next steps' for when a hit is found.

Practice this question →

MCQhard

An attacker has cleared the Windows Event Logs to hide their tracks. You are hunting for this activity. Which Event ID in the System log indicates that the log service was stopped or cleared?

A.Event ID 1102

B.Event ID 4688

C.Event ID 7036

D.Event ID 4624

AnswerA

Indicates the audit log was cleared.

Why this answer

Event ID 1102 is the specific Windows event logged when the Security audit log is cleared.

Practice this question →

Multi-Selecthard

You are hunting for anomalous PowerShell activity. Which THREE indicators or behaviors should you look for in your Splunk data?

Select 3 answers

A.Presence of '-enc' or '-encodedcommand' flags

B.Execution of 'Get-Service' commands

C.PowerShell spawning processes like 'wmic.exe' or 'certutil.exe'

D.User logons via RDP

E.Network connections originating from 'powershell.exe'

AnswersA, C, E

These are standard indicators of obfuscated PowerShell scripts.

Why this answer

Obfuscation (encoded commands), network callbacks, and unusual execution paths are classic signs of PowerShell abuse.

Practice this question →

MCQhard

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

A.dst_ip

B.remote_address

C.dest

D.target_ip

AnswerC

'dest' is the mandated field name for destinations in the CIM.

Why this answer

The CIM 'Network Traffic' data model standardizes the destination IP field as 'dest' to ensure cross-source compatibility.

Practice this question →

Multi-Selectmedium

Which TWO actions should be performed during the 'Data Preparation' phase of a threat hunt to ensure accurate results?

Select 2 answers

A.Mapping data sources to the Splunk Common Information Model (CIM)

B.Applying machine learning models

C.Creating new user accounts

D.Verifying data availability for the required time range

E.Drafting the final incident report

AnswersA, D

CIM normalization is critical for cross-source search effectiveness.

Why this answer

Ensuring data is mapped to the CIM and that the required fields are available are essential for reliable hunting.

Practice this question →

MCQeasy

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

A.To increase the search speed

B.To clear the cache

C.To reduce the number of false positives

D.To align with attacker dwell time

AnswerD

This accounts for the delay between compromise and discovery.

Why this answer

The lookback period ensures the hunter scans enough historical data to cover the likely dwell time of an attacker.

Practice this question →

MCQmedium

You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?

A.EventCode 1

B.EventCode 11

C.EventCode 10

D.EventCode 3

AnswerC

Event ID 10 is specifically designed for process access monitoring.

Why this answer

Sysmon Event ID 10 captures ProcessAccess, which is the standard event logged when a process like a credential dumper accesses the memory of lsass.exe.

Practice this question →

Multi-Selecthard

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

Select 3 answers

A.Deleting raw logs after indexing

B.Using 'NOT' clauses to exclude known administrative processes

C.Increasing the search time range

D.Implementing lookup tables to exclude known-good baselines

E.Adjusting the threshold for rarity in the 'rare' command

AnswersB, D, E

Explicit exclusion is a common method for cleaning results.

Why this answer

Filtering known-good values, using lookup tables for exclusions, and weighting alerts are all standard methods for noise reduction.

Practice this question →

MCQmedium

You are conducting a hunt for unauthorized remote access tools. Which Splunk command is most effective for identifying processes that are running from unusual directories (e.g., AppData, Temp)?

A.index=windows | table Image | sort Image

B.index=windows | stats count by Image | where like(Image, "%\\AppData%")

C.index=windows | search Image="*" | head 100

D.index=windows | rare Image

AnswerB

This effectively filters for processes running from the AppData directory.

Why this answer

Filtering by 'Image' and using 'where' to identify paths containing 'AppData' or 'Temp' is a standard way to find suspicious persistence.

Practice this question →

MCQeasy

Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?

A.Saved Search

B.Data Model Acceleration

C.Search Macro

D.Event Type

AnswerC

Macros allow for reusable, parameterizable SPL blocks.

Why this answer

Splunk 'Reports' allow for saved searches, but 'Lookup Definitions' or 'Macros' are used for reusability. Macros are the standard way to parameterize queries.

Practice this question →

MCQmedium

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

A.eval decoded=base64_decode(field)

B.rex field=field "(?<decoded>.*)"

C.transform base64 field

D.eval decoded=decode(field, "base64")

AnswerA

This is the correct syntax for decoding Base64 strings.

Why this answer

The 'base64_decode' function in SPL is designed to handle this specific transformation.

Practice this question →

MCQmedium

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

A.index=windows EventCode=4697 | table User, ServiceName

B.index=windows EventCode=4688 | stats count by ParentProcessName, ProcessName

C.index=windows EventCode=4624 | table Logon_Type, User

D.index=windows EventCode=7045 | stats count by ServiceName

AnswerB

This efficiently isolates process lineage to spot anomalous spawns from wmiprvse.exe.

Why this answer

Identifying abnormal parent-child relationships is a core hunting technique. Using tstats to aggregate process parent-child pairs is efficient.

Practice this question →

MCQhard

You are analyzing a data model using tstats. You need to identify rare process executions across your environment. Which command structure provides the most performance-optimized result?

A.| tstats summariesonly=t count from datamodel=Endpoint.Processes by Processes.process_name | sort count

B.| inputlookup processes.csv | stats count

C.index=windows | rare limit=20 ProcessName

D.| search index=windows | stats count by ProcessName | sort -count

AnswerA

This is the most efficient method using pre-calculated data models.

Why this answer

Using tstats with the 'summariesonly=true' parameter leverages accelerated data models, providing significantly faster results for large datasets.

Practice this question →

MCQmedium

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

A.Event ID 7

B.Event ID 2

C.Event ID 5

D.Event ID 1

AnswerD

Event ID 1 provides the full command line string.

Why this answer

Event ID 1 (Process Creation) provides the full command line, including arguments, which is essential for detecting LotL techniques.

Practice this question →

Multi-Selecthard

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Select 3 answers

A.Windows Security Event ID 4688 (Process Creation)

B.Windows System Event ID 7045 (Service Installation)

C.Windows System Event ID 104 (Log Cleared)

D.Windows Security Event ID 4611 (Trusted Logon)

E.Windows Security Event ID 4624 (Logon)

AnswersA, B, E

This tracks what the user runs after authenticating.

Why this answer

Authentication logs (4624), process execution (4688), and service installation (7045) provide the necessary context to track an attacker moving between hosts.

Practice this question →

Multi-Selectmedium

Which TWO Splunk features are best for automating the execution of recurring threat hunts?

Select 2 answers

A.Data Model Acceleration

B.Scheduled Searches

C.User Roles

D.Alert Actions

E.Splunk Web Framework

AnswersB, D

This is the native way to automate repeated hunts.

Why this answer

Scheduled searches and Alerts are the primary mechanisms for triggering automated hunt logic.

Practice this question →