Free Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A hunt team collects detailed telemetry but normally executes procedures designed by other teams. Which Hunting Maturity Model level best describes this capability?

   1. A.HMM2, ProceduralCorrect answer: A
   2. B.HMM0, Initial
   3. C.HMM3, Innovative
   4. D.HMM4, Leading

   Explanation: The source states, "generally following hunts designed by others". The team can execute established hunts but does not yet create novel procedures or automate most hunts; that is HMM2.

   Reference: Measuring Hunting Success with PEAK — Measuring Program Maturity

2. 2A hunter must model an application's components and how data moves between them before identifying threats. Which representation directly supports this task?

   1. A.An attack tree of alternative intrusion paths
   2. B.A data flow diagramCorrect answer: B
   3. C.A CVSS vector describing vulnerability severity
   4. D.A Cyber Kill Chain map of intrusion stages

   Explanation: The source states, "data flow diagrams (DFDs)". A DFD represents components and data interactions. Attack trees organize attack paths, CVSS vectors describe severity, and Kill Chain maps organize intrusion stages rather than application data flows.

   Reference: OWASP Threat Modeling Cheat Sheet — System Modeling

3. 3A compromised host runs net user /domain. What behavior should the hunter initially map from that command?

   1. A.Creation of a new local account
   2. B.Enumeration of domain account informationCorrect answer: B
   3. C.Modification of a domain password policy
   4. D.Deletion of an existing domain account

   Explanation: The source states, "net user /domain". The command enumerates domain account information. It does not, by itself, create or delete accounts or modify password policy.

   Reference: MITRE ATT&CK Domain Account Discovery — Description

4. 4A PowerShell hunt repeatedly reads a large Windows event log and then pipes every record to Where-Object. Which change directly improves filtering efficiency?

   1. A.Sort the full event stream before filtering
   2. B.Convert every event to formatted text first
   3. C.Use Get-WinEvent with a FilterHashtable queryCorrect answer: C
   4. D.Read the same log twice and compare counts

   Explanation: The source states, "Performance improves when a Get-WinEvent query uses the FilterHashtable parameter.". FilterHashtable narrows the event query directly. Formatting, sorting or rereading the full stream adds work instead of reducing it.

   Reference: Microsoft Get-WinEvent FilterHashtable queries — FilterHashtable introduction

5. 5An incident plan permits live acquisition from a stable host, and suspected malicious code may exist only in RAM. No immediate safety action requires shutdown. What should the investigator prioritize before powering it off?

   1. A.Acquire only a forensic image of the persistent disk
   2. B.Collect the relevant volatile memory evidenceCorrect answer: B
   3. C.Export only the persistent Registry hive files
   4. D.Collect only the event logs already saved on disk

   Explanation: The source states, "Volatile data refers to data on a live system that is lost after a computer is powered down". Under the permitted live-acquisition conditions, collect the relevant RAM evidence before shutdown. Disk images, persistent hive files and saved logs do not preserve RAM-only code.

   Reference: NIST SP 800-86 Integrating Forensic Techniques into Incident Response — section 3.1, Volatility

6. 6A hunt links a malicious email, endpoint process activity and outbound network traffic to the same affected host. What is the main investigative benefit of integrating those product observations?

   1. A.Increasing the count of independent alerts
   2. B.Replacing all raw evidence with a common severity number
   3. C.Reconstructing related activity across security domainsCorrect answer: C
   4. D.Treating every shared IP as the same malicious process

   Explanation: The source states, "collect and correlate data". Cross-domain correlation builds incident context that separate observations lack. Alert count or a common severity label does not itself reconstruct relationships, and shared IPs require contextual validation.

   Reference: Cisco XDR product documentation — Cisco XDR overview

7. 7A team wants to move from following published hunts to HMM3. Which improvement directly demonstrates that change?

   1. A.Increase the amount of searchable telemetry
   2. B.Create novel hunt procedures internallyCorrect answer: B
   3. C.Execute established hunt procedures more frequently
   4. D.Automate most hunts into continuous detections

   Explanation: The source states, "creating novel hunt procedures". Original hunt design demonstrates HMM3. Alert subscriptions do not show that capability, and universal automation is neither the stated milestone nor justified.

   Reference: Measuring Hunting Success with PEAK — Measuring Program Maturity

8. 8A team has mapped components, data flows and trust boundaries and wants systematic security-threat prompts for each. Which approach is the best fit?

   1. A.Use CVSS to assign vulnerability severity vectors
   2. B.Use the Kill Chain to identify intrusion stages
   3. C.Apply STRIDE categories to the modelCorrect answer: C
   4. D.Use the Pyramid of Pain to rank indicator types

   Explanation: The source states, "components, data flows, and trust boundaries". In its STRIDE guidance, these elements receive systematic threat-category analysis. Severity vectors, intrusion stages and indicator difficulty address different questions.

   Reference: OWASP Threat Modeling Cheat Sheet — Choosing a Threat Modeling Technique, STRIDE

9. 9A log records schtasks /create with an ONLOGON trigger pointing to an attacker-controlled executable. Which mechanism is being configured?

   1. A.A Windows service start type
   2. B.A Registry Run value
   3. C.A scheduled task for logon executionCorrect answer: C
   4. D.An inbound RDP listener

   Explanation: The source states, "task scheduling for initial or recurring execution". The schtasks command and logon trigger establish scheduled execution. Service, Registry Run and RDP configuration are different mechanisms.

   Reference: MITRE ATT&CK Scheduled Task — Description and APT3 procedure example

10. 10A Python hunt reads newline-delimited JSON logs. For each line containing one JSON object, which operation converts its text into a Python object for field-based analysis?

    1. A.json.dumps(line)
    2. B.str(line)
    3. C.repr(line)
    4. D.json.loads(line)Correct answer: D

    Explanation: The source states, "deserialize s". loads deserializes JSON text. dumps serializes an object; str and repr do not parse JSON into its fields.

    Reference: Python json module documentation — json.loads