Back to Subject

Unit 6: Advanced Threat Hunting and Future Trends - Practice Quiz

INT244 — Securing Computing Systems 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 What is threat intelligence?

Threat Intelligence and Advanced Threat Hunting: introduction Easy
A. A backup of critical business data
B. A tool for increasing network speed
C. Analyzed information about cyber threats
D. A policy for purchasing computer hardware

2 What is the main purpose of threat hunting?

Threat Intelligence and Advanced Threat Hunting: introduction Easy
A. To proactively search for hidden threats
B. To improve the speed of applications
C. To replace all network security controls
D. To create backups of security logs

3 What usually begins a hypothesis-driven threat hunt?

Threat Intelligence and Advanced Threat Hunting: advanced threat-hunting methodologies Easy
A. A request to upgrade computer hardware
B. A complete shutdown of every monitored system until the investigation has ended
C. A testable idea about suspicious activity
D. A plan to remove all existing security policies

4 Which item is an example of an indicator of compromise (IOC)?

Threat Intelligence and Advanced Threat Hunting: advanced threat-hunting methodologies Easy
A. A scheduled employee training session
B. A newly purchased office printer
C. A standard software license agreement
D. A known malicious IP address

5 Which activity is part of the threat intelligence lifecycle?

Threat Intelligence and Advanced Threat Hunting: lifecycle intelligence for automated response Easy
A. Ordering replacement keyboards
B. Designing a company logo
C. Collecting relevant threat data
D. Increasing monitor brightness

6 How can threat intelligence support an automated response?

Threat Intelligence and Advanced Threat Hunting: lifecycle intelligence for automated response Easy
A. By triggering actions from known indicators
B. By eliminating the need for security monitoring
C. By automatically writing every company policy
D. By physically repairing damaged computers

7 Which data source is especially useful for cloud threat hunting?

Threat Intelligence and Advanced Threat Hunting: techniques for effective threat hunting in the cloud Easy
A. Cloud audit and activity logs
B. Printed equipment instruction manuals
C. Office building maintenance reports
D. Employee cafeteria order records

8 Why should cloud threat hunters monitor identity activity?

Threat Intelligence and Advanced Threat Hunting: techniques for effective threat hunting in the cloud Easy
A. To ensure every employee uses the same device model and operating system version
B. To calculate the cost of office furniture
C. To detect compromised user accounts
D. To measure the physical temperature of servers

9 What does behavioral analytics commonly establish for each user?

Threat Intelligence and Advanced Threat Hunting: behavioral analytics for detecting insider threats Easy
A. A baseline of normal activity
B. A map of office seating locations
C. A schedule of hardware purchases
D. A list of preferred software colors

10 Which behavior could indicate a possible insider threat?

Threat Intelligence and Advanced Threat Hunting: behavioral analytics for detecting insider threats Easy
A. Downloading unusually large amounts of data
B. Attending a scheduled security awareness course
C. Using a company-approved collaboration tool
D. Installing an approved operating system update

11 What is the main role of a Security Operations Center (SOC)?

Emerging Trends and the Future of SOC Analysis: introduction Easy
A. Designing physical office spaces
B. Monitoring and responding to security threats
C. Processing employee travel expenses
D. Managing product advertising and sales

12 Who typically investigates security alerts in a SOC?

Emerging Trends and the Future of SOC Analysis: introduction Easy
A. Sales representatives
B. Graphic designers
C. Building architects
D. SOC analysts

13 Which technology is increasingly used to identify patterns in large volumes of SOC data?

Emerging Trends and the Future of SOC Analysis: emerging trends and the future of SOC analysis Easy
A. A manual process that permanently replaces every security tool and analyst in the SOC
B. Analog photography
C. Machine learning
D. Mechanical printing

14 How does cloud computing affect SOC monitoring?

Emerging Trends and the Future of SOC Analysis: impact of cloud security on SOC operations Easy
A. It removes the need to monitor identities
B. It limits incidents to physical servers
C. It prevents the collection of security logs
D. It expands monitoring beyond local networks

15 Which characteristic can make cloud assets harder for a SOC to track?

Emerging Trends and the Future of SOC Analysis: impact of cloud security on SOC operations Easy
A. Their rapid and temporary creation
B. Their complete lack of user identities
C. Their inability to generate activity logs
D. Their permanent physical location

16 Which capability is likely to become more important in future SOC operations?

Emerging Trends and the Future of SOC Analysis: predicting future directions Easy
A. Automating repetitive investigation tasks
B. Avoiding integration between security tools
C. Replacing digital logs with paper records
D. Disabling all sources of security alerts

17 Why do SOC analysts need continuous training?

Emerging Trends and the Future of SOC Analysis: predicting future directions Easy
A. Security tools never receive updates
B. Cloud services eliminate security risks
C. Cyberattacks always use one technique
D. Threats and technologies keep changing

18 What does SOAR stand for in cybersecurity?

Emerging Trends and the Future of SOC Analysis: SOAR Easy
A. Security Orchestration, Automation, and Response
B. System Optimization, Auditing, and Recovery
C. Software Organization and Automated Resource Management for Every Department
D. Security Operations, Assessment, and Reporting

19 What is a SOAR playbook?

Emerging Trends and the Future of SOC Analysis: SOAR Easy
A. A guide for assembling computer hardware
B. A predefined incident-response workflow
C. A list of employee contact details
D. A record of monthly software expenses

20 Which statement best represents the zero-trust security model?

Emerging Trends and the Future of SOC Analysis: zero-trust security model Easy
A. Verify devices only during initial setup
B. Trust every user inside the network
C. Allow broad access after one login
D. Never trust automatically; always verify

21 A SOC receives a list of malicious IP addresses from an industry-sharing group. What should analysts do first before blocking every address?

Threat Intelligence and Advanced Threat Hunting: introduction Medium
A. Block the indicators immediately across all security controls
B. Replace existing detection rules with the shared indicator list
C. Validate the indicators against internal telemetry and business context
D. Delete historical events associated with the listed indicators

22 Which activity best distinguishes proactive threat hunting from routine alert monitoring?

Threat Intelligence and Advanced Threat Hunting: introduction Medium
A. Closing duplicate alerts generated by multiple security tools
B. Escalating confirmed incidents to the response team
C. Investigating hypotheses even when no alert has been generated
D. Reviewing alerts according to their assigned severity levels

23 A hunter suspects that attackers are using PowerShell to download payloads. Which hypothesis-driven approach is most appropriate?

Threat Intelligence and Advanced Threat Hunting: advanced threat-hunting methodologies Medium
A. Review firewall configuration changes from the previous year
B. Scan all servers only for known malicious file hashes
C. Search process and network logs for unusual PowerShell connections
D. Disable PowerShell immediately on every managed endpoint

24 During a hunt mapped to the MITRE ATT&CK framework, analysts find repeated attempts to dump credentials from endpoint memory. How should this finding primarily be used?

Threat Intelligence and Advanced Threat Hunting: advanced threat-hunting methodologies Medium
A. Assign the activity directly to a specific threat group
B. Map the activity to a technique and search for related behaviors
C. Remove unrelated endpoint events from the investigation
D. Treat the activity as harmless unless malware is recovered

25 A phishing indicator has moved from newly observed to confirmed malicious during the intelligence lifecycle. Which automated response is most appropriate?

Threat Intelligence and Advanced Threat Hunting: lifecycle intelligence for automated response Medium
A. Archive the indicator without changing security controls
B. Isolate every endpoint regardless of indicator exposure
C. Block the indicator and search historical telemetry for matches
D. Delete all messages received during the same time period

26 Why should an automated response workflow assign expiration times to threat indicators?

Threat Intelligence and Advanced Threat Hunting: lifecycle intelligence for automated response Medium
A. To make all intelligence sources equally trusted over time
B. To prevent outdated indicators from causing unnecessary disruption
C. To ensure indicators remain blocked after they become irrelevant
D. To remove the need for confidence scoring and validation

27 An attacker creates a new cloud access key and uses it from an unfamiliar country. Which data combination is most useful for investigating the event?

Threat Intelligence and Advanced Threat Hunting: techniques for effective threat hunting in the cloud Medium
A. Backup schedules, software licenses, and office locations
B. Application screenshots, source code, and DNS zone names
C. Printer logs, endpoint wallpaper, and asset purchase dates
D. Cloud audit logs, identity events, and geolocation data

28 A cloud workload is short-lived and may disappear before an investigation begins. Which practice best preserves evidence for threat hunting?

Threat Intelligence and Advanced Threat Hunting: techniques for effective threat hunting in the cloud Medium
A. Disable autoscaling until analysts complete every investigation
B. Collect logs manually only after an incident is confirmed
C. Centralize workload, control-plane, and network logs continuously
D. Store each workload's logs only on its local file system

29 An employee who normally accesses a few customer records downloads thousands shortly before resigning. Which detection method best identifies this risk?

Threat Intelligence and Advanced Threat Hunting: behavioral analytics for detecting insider threats Medium
A. Treat the download as safe because valid credentials were used
B. Compare the activity with the user's established behavioral baseline
C. Search only for malware signatures on the employee's computer
D. Block all customer-record access outside standard office hours

30 A privileged administrator regularly transfers large backup files as part of assigned duties. How should a behavioral analytics system reduce false positives for this activity?

Threat Intelligence and Advanced Threat Hunting: behavioral analytics for detecting insider threats Medium
A. Alert whenever any user transfers more than one file
B. Apply identical access thresholds to all organizational roles
C. Build role-aware baselines that include the administrator's normal duties
D. Exclude every privileged account from behavioral monitoring

31 A modern SOC is overwhelmed by alerts from endpoints, cloud platforms, and identity systems. Which capability most directly improves cross-environment investigation?

Emerging Trends and the Future of SOC Analysis: introduction Medium
A. Centralized correlation of telemetry from multiple security sources
B. Manual duplication of every alert into separate tracking systems
C. Independent review of each tool without shared incident context
D. Longer retention of alerts without normalization or prioritization

32 A SOC deploys machine learning to prioritize alerts. Which practice is most important for maintaining reliable results as attacker behavior changes?

Emerging Trends and the Future of SOC Analysis: emerging trends and the future of SOC analysis Medium
A. Remove analyst feedback from the model evaluation process
B. Allow the model to close every high-risk alert automatically
C. Keep the initial model unchanged to preserve consistency
D. Monitor model performance and retrain it with relevant data

33 How can generative AI most appropriately assist a SOC analyst during an investigation?

Emerging Trends and the Future of SOC Analysis: emerging trends and the future of SOC analysis Medium
A. Assign threat attribution without supporting intelligence sources
B. Replace all telemetry collection with generated incident narratives
C. Summarize evidence and suggest queries for analyst validation
D. Execute destructive containment actions without human approval

34 A company adopts several SaaS and infrastructure cloud providers. What is the most significant operational change required in its SOC?

Emerging Trends and the Future of SOC Analysis: impact of cloud security on SOC operations Medium
A. Monitor only physical network devices located in company offices
B. Integrate provider telemetry and understand shared-responsibility boundaries
C. Use endpoint antivirus as the sole source of cloud visibility
D. Transfer all detection responsibilities to the cloud providers

35 A SOC detects repeated cloud storage misconfigurations across multiple accounts. Which improvement would address the issue most effectively?

Emerging Trends and the Future of SOC Analysis: impact of cloud security on SOC operations Medium
A. Disable cloud audit logging to reduce the number of alerts
B. Focus investigations only on storage systems already breached
C. Continuously evaluate configurations against approved security policies
D. Review storage settings only during the annual compliance audit

36 Which development is most likely to increase the need for identity-focused detection in future SOC operations?

Emerging Trends and the Future of SOC Analysis: predicting future directions Medium
A. Decline in the use of authentication for sensitive resources
B. Replacement of digital services with isolated paper processes
C. Growth in cloud services, remote access, and machine identities
D. Elimination of third-party access to organizational systems

37 A SOC leader is planning for attackers who increasingly use automation. Which investment best prepares the SOC for this trend?

Emerging Trends and the Future of SOC Analysis: predicting future directions Medium
A. Complete reliance on static signatures created during deployment
B. Permanent suppression of alerts generated outside business hours
C. Monthly manual log reviews performed by a single analyst
D. Real-time analytics combined with controlled response automation

38 A SOAR playbook receives an alert about a suspicious email attachment. Which sequence is the most appropriate automated workflow?

Emerging Trends and the Future of SOC Analysis: SOAR Medium
A. Enrich the alert, assess risk, quarantine the email, and notify analysts
B. Notify analysts, ignore enrichment, and permanently disable email
C. Delete all employee email, reset every password, and close the alert
D. Close the alert, archive the attachment, and remove related telemetry

39 Which incident is the best candidate for initial SOAR implementation?

Emerging Trends and the Future of SOC Analysis: SOAR Medium
A. A rare nation-state intrusion requiring extensive strategic judgment
B. A legal investigation requiring case-specific executive decisions
C. A frequent phishing alert with stable and documented response steps
D. An unknown outage with no available telemetry or response procedure

40 A user authenticated successfully in the morning but later connects from an unmanaged device to a sensitive database. What should a zero-trust system do?

Emerging Trends and the Future of SOC Analysis: zero-trust security model Medium
A. Trust the connection because it originates from the corporate network
B. Grant permanent database access based only on the user's department
C. Reevaluate identity, device posture, and access context before allowing access
D. Allow access because the user completed authentication earlier that day

41 A threat-hunting team receives an intelligence report describing an adversary's preferred tools but no confirmed indicators of compromise. What is the most defensible first action?

Threat Intelligence and Advanced Threat Hunting: introduction Hard
A. Block every domain associated with the adversary
B. Search only for the listed file hashes
C. Wait until an internal alert confirms the report
D. Translate the report into testable behavioral hypotheses

42 Which combination best distinguishes advanced threat hunting from conventional alert-driven monitoring?

Threat Intelligence and Advanced Threat Hunting: introduction Hard
A. Automated blocking of all suspicious addresses
B. Continuous hypothesis testing across weak signals
C. Centralized logging with longer retention periods
D. Higher alert volume with stricter severity thresholds

43 A hunter wants to test whether an attacker is using valid accounts for lateral movement without relying on known malware signatures. Which approach is strongest?

Threat Intelligence and Advanced Threat Hunting: advanced threat-hunting methodologies Hard
A. Compare authentication paths with established user baselines
B. Block all logins occurring outside business hours
C. Search proxy logs for previously reported malware domains
D. Scan endpoints exclusively for unsigned executables

44 In a detection-engineering feedback loop, a hunt finds repeated benign administrative activity that triggers a high-confidence rule. What is the most appropriate next step?

Threat Intelligence and Advanced Threat Hunting: advanced threat-hunting methodologies Hard
A. Refine the rule using contextual discriminators
B. Delete the rule because it produced false positives
C. Increase the rule severity to force analyst review
D. Suppress all activity from the administrative account

45 Why should confidence, freshness, and provenance be attached to intelligence before it drives automated containment?

Threat Intelligence and Advanced Threat Hunting: lifecycle intelligence for automated response Hard
A. They determine whether an indicator can be safely acted upon
B. They eliminate the need for analyst review during incidents
C. They convert tactical indicators into permanent blocking rules
D. They guarantee that every indicator identifies a compromised host

46 An IP reputation feed marks a shared cloud address as malicious, but the address is now assigned to unrelated tenants. Which lifecycle control is most important before automated blocking?

Threat Intelligence and Advanced Threat Hunting: lifecycle intelligence for automated response Hard
A. Apply the block to every connected subnet
B. Require contextual enrichment and confidence validation
C. Increase the indicator's expiration period
D. Replace the IP indicator with a broader country block

47 Which design best prevents an automated response playbook from repeatedly re-triggering itself during an incident?

Threat Intelligence and Advanced Threat Hunting: lifecycle intelligence for automated response Hard
A. Disable all response actions after the first execution
B. Route every repeated event to a separate analyst queue
C. Increase the number of response actions per alert
D. Use idempotent actions with state tracking and suppression

48 A cloud hunter investigates suspected credential compromise. Which evidence set provides the strongest basis for identifying anomalous use of the credential?

Threat Intelligence and Advanced Threat Hunting: techniques for effective threat hunting in the cloud Hard
A. API calls, token context, resource paths, and timing
B. Login country and password age only
C. Endpoint antivirus results and local file names
D. Cloud provider status pages and billing summaries

49 A cloud storage exposure hunt produces inconsistent results because object access logs are absent in some accounts. What is the primary analytical limitation?

Threat Intelligence and Advanced Threat Hunting: techniques for effective threat hunting in the cloud Hard
A. The hunt remains complete if identity-provider logs are available
B. The hunt can rely on network flow logs to reconstruct every object read
C. The hunt will automatically overestimate the number of exposed objects
D. The hunt cannot distinguish absence of evidence from evidence of absence

50 Which cloud hunting strategy is most resilient to rapidly changing workloads and ephemeral resources?

Threat Intelligence and Advanced Threat Hunting: techniques for effective threat hunting in the cloud Hard
A. Depend on fixed IP allowlists for workload attribution
B. Prioritize identities, control-plane actions, and resource relationships
C. Investigate only long-lived virtual machines
D. Track immutable hostnames across every deployment

51 Why is a peer-group baseline generally preferable to a single global baseline for insider-threat detection?

Threat Intelligence and Advanced Threat Hunting: behavioral analytics for detecting insider threats Hard
A. It guarantees that anomalous behavior is malicious
B. It removes the need to understand job responsibilities
C. It reduces legitimate-role variation being mistaken for abuse
D. It makes rare but authorized actions impossible

52 An employee downloads unusually large datasets shortly before resignation, but the downloads match an approved migration project. Which response best reflects sound behavioral analytics?

Threat Intelligence and Advanced Threat Hunting: behavioral analytics for detecting insider threats Hard
A. Treat the event as malicious because the timing is suspicious
B. Ignore the event because approved projects cannot be abused
C. Correlate authorization, destination, scope, and project evidence
D. Disable the employee account until the investigation is complete

53 Which modeling error most directly increases false positives when detecting insider threats in a highly seasonal business?

Threat Intelligence and Advanced Threat Hunting: behavioral analytics for detecting insider threats Hard
A. Using a static baseline that ignores predictable seasonal changes
B. Including access times and data volume in the feature set
C. Separating privileged users from ordinary users
D. Requiring corroboration from multiple independent signals

54 What is the central analytical challenge created by the increasing automation of SOC operations?

Emerging Trends and the Future of SOC Analysis: introduction Hard
A. Ensuring analysts manually execute every containment action
B. Maintaining human oversight over opaque and consequential decisions
C. Replacing all telemetry with endpoint-only measurements
D. Eliminating the need for incident prioritization

55 A SOC adopts an AI-assisted detection system that lowers alert volume but occasionally suppresses novel attack patterns. Which metric pairing best exposes this trade-off?

Emerging Trends and the Future of SOC Analysis: emerging trends and the future of SOC analysis Hard
A. Mean time to acknowledge and analyst attendance
B. False-negative rate and detection coverage over attack techniques
C. Alert count and total log ingestion
D. Number of dashboards and storage utilization

56 In a multi-cloud environment, what operational change is most necessary for reliable SOC analysis?

Emerging Trends and the Future of SOC Analysis: impact of cloud security on SOC operations Hard
A. Use one provider's native event schema without transformation
B. Collect only perimeter firewall logs from each provider
C. Normalize identity, resource, and action semantics across providers
D. Assign each cloud provider to an isolated SOC with no correlation

57 Which capability is most likely to distinguish mature future SOCs from organizations that merely deploy more security tools?

Emerging Trends and the Future of SOC Analysis: predicting future directions Hard
A. Maximum retention of every event without prioritization
B. Continuous validation of controls against adversary behavior
C. A larger number of independent alert consoles
D. More frequent replacement of detection products

58 A SOAR playbook enriches an alert, isolates a host, and opens a ticket. Which design most appropriately limits operational risk?

Emerging Trends and the Future of SOC Analysis: SOAR Hard
A. Execute all actions automatically for every matching alert
B. Skip enrichment because containment is always the priority
C. Use severity gates, approval points, rollback steps, and audit logs
D. Allow each integration to make independent containment decisions

59 A zero-trust architecture detects a valid user accessing a sensitive application from a managed device. Which additional decision input is most important before granting access?

Emerging Trends and the Future of SOC Analysis: zero-trust security model Hard
A. A permanent allowlist entry for the user's department
B. Continuous context including device posture and requested resource
C. The user's historical login count alone
D. The fact that the device is inside the corporate network

60 Which SOC telemetry pattern most strongly indicates that a zero-trust policy is being bypassed through excessive privilege?

Emerging Trends and the Future of SOC Analysis: zero-trust security model Hard
A. Short sessions that access only assigned applications
B. Repeated access denials followed by successful authorized access
C. Users authenticating through the organization's identity provider
D. Routine access to low-sensitivity resources during working hours
Previous MCQ
Unit 5