OpenExamsFREE PRACTICE — ANY EXAM

Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity — Information & Free Practice

100 free questions · Answer explanations · No signup required

Start free practice →

Exam Review

About Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity

Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity · US

Key exam facts

Provider
Cisco owns the examination; Pearson VUE is Cisco's testing delivery partner.
Format
Proctored computer-delivered exam, at Pearson VUE test centers or online through OnVUE in the US. Published formats include performance-based questions, multiple choice and drag-and-drop; no CBRTHD-specific percentage mix is published.
Time limit
90 minutes of examination time.
Passing score
Pass/fail. Cisco sets passing scores statistically and does not publish them; no fixed numerical passing threshold or score scale is given in the published scoring policy.
Exam fee
US$300 for the 300-220 CBRTHD examination, or redeem Cisco Learning Credits.

Topics covered

  • Threat Hunting Fundamentals (20%)

    • Apply the Threat Hunting Maturity Model to an organization's environment, as it relates to the Pyramid of Pain
    • Describe threats and how to model them with standards such as MITRE ATT&CK, MITRE CAPEC, TaHiTI, and PASTA
    • Describe the limiting factors of detection tools for malware behavior, propagation, and detection
    • Describe the advantages and disadvantages of automation such as artificial intelligence and machine learning in the operation of a SOC
    • Determine differences in tactics, techniques, and procedures of an advanced persistent threat and threat actor using logs
    • Interpret a threat intelligence report and draw conclusions about a threat actor (known advanced persistent threat/commodity human-driven/commodity machine-driven)
    • tactics
    • techniques
    • procedures

  • Threat Modeling Techniques (10%)

    • Select the threat modeling approach for a given scenario
    • Use MITRE ATT&CK to model threats (tactics, techniques, and procedures or changes in tactics, techniques, and procedures)
    • Describe the uses of structured and unstructured threat hunting
    • Determine the priority level of attacks based on the Cyber Kill Chain and MITRE ATT&CK
    • Determine the priority level of attacks based on the MITRE CAPEC model
    • Perform threat intelligence handling: gathering, cataloging, utilizing, and removing

  • Threat Actor Attribution Techniques (20%)

    • Determine attack tactics, techniques, and procedures using logs
    • Interpret tactics, techniques and procedures of a given threat actor
    • Select the delivery method, payload, tactic, or timeline that indicates an authorized assessment or an attack (threat actor or penetration tester)
    • Determine usable artifacts for detection of advanced persistent threat actors at all levels of the Pyramid of Pain
    • tactics
    • techniques
    • procedures

  • Threat Hunting Techniques (20%)

    • Use scripting languages such as Python and PowerShell to augment detection or analytics
    • Perform a cloud-native threat hunt
    • Determine undetected threats using SIEM data and endpoint artifacts
    • Determine the C2 communications to and from infected hosts using endpoint applications, processes, and logs
    • Select suspicious activity using session and protocol data
    • Determine the stage of infection within C2 communications using traffic data
    • Select weakness in code using code-level analysis tools such as PE Checker, BURP Suite, and SEM Grep
    • Describe the analysis process for applications and operating systems used by IoT devices
    • Describe memory-resident attacks and how to perform analysis using memory-specific tools such as volatility
    • Construct a signature for detection or analysis
    • Recognize the likelihood of attack by an attack vector within a given environment

  • Threat Hunting Processes (20%)

    • Describe the process to identify memory-resident attacks
    • Determine compromises by reverse engineering
    • Determine known and unknown gaps in detection
    • vulnerabilities
    • configuration errors
    • threats
    • Interpret data from memory-specific tools
    • Construct a runbook or playbook to address a detectable scenario
    • Recommend tools, configurations, detection, and deception techniques for a given scenario
    • Recommend attack remediation strategies based on the results of a threat assessment
    • Recommend changes to improve the effectiveness and efficiency of a threat hunt
    • Recommend security countermeasures and mitigations for identified risks

  • Threat Hunting Outcomes (10%)

    • Describe how multiproduct integration enhances data visibility within a product and accelerates analysis
    • Diagnose analytical gaps using threat hunting methodologies
    • Recommend a mitigation strategy to block C2 traffic
    • Recommend changes in hunt capability to advance to the next Threat Hunting Maturity Model phase
    • Recommend changes to a detection methodology to augment analytical and process gaps
    • Use presentation resources to convey findings and direct environmental change

How to prepare

Work through the topics, read the explanation after each answer, and revisit the areas where you miss questions. Use the official outline and reference materials below to guide your study.

These independent practice questions are not actual exam items and do not guarantee a passing result.

Frequently asked questions

What is the exam format?

Proctored computer-delivered exam, at Pearson VUE test centers or online through OnVUE in the US. Published formats include performance-based questions, multiple choice and drag-and-drop; no CBRTHD-specific percentage mix is published.

How long is the exam?

90 minutes of examination time.

What is the passing score?

Pass/fail. Cisco sets passing scores statistically and does not publish them; no fixed numerical passing threshold or score scale is given in the published scoring policy.

How much does the exam cost?

US$300 for the 300-220 CBRTHD examination, or redeem Cisco Learning Credits.

Official sources and references

Confirm current exam arrangements with the exam provider.