What is the main difference between hypothesis-driven and data-driven Threat Hunting?

1. A. Data-driven hunts always require more data to search through than hypothesis-driven hunts.
2. B. Data-driven hunting tries to uncover activity within an existing data set, hypothesis- driven hunting begins with a potential activity that the hunter thinks may be happening.
3. C. Hypothesis-driven hunts are typically executed on newly ingested data sources, while data-driven hunts are not.
4. D. Hypothesis-driven hunting tries to uncover activity within an existing data set, data- driven hunting begins with an activity that the hunter thinks may be happening.

Correct Answer: B
The main difference between hypothesis-driven and data-driven threat hunting lies in the approach. Inhypothesis-drivenhunting, the hunter starts with a theory or hypothesis about what kind of malicious activity might be occurring and then searches the data to confirm or refute that hypothesis. On the other hand,data-drivenhunting involves sifting through existing datasets to uncover patterns, anomalies, or activities that were not initially suspected. Hypothesis-driven approaches are more focused and often guided by threat intelligence or knowledge of attacker behaviors, while data-driven approaches rely on broad data analysis to identify unexpected threats.

Which of the following is a best practice for searching in Splunk?

1. A. Streaming commands run before aggregating commands in the Search pipeline.
2. B. Raw word searches should contain multiple wildcards to ensure all edge cases are covered.
3. C. Limit fields returned from the search utilizing the cable command.
4. D. Searching over All Time ensures that all relevant data is returned.

Correct Answer: A
In Splunk,streaming commandsprocess each event individually as it is passed through the search pipeline and should be placed beforeaggregating commands, which operate on the entire set of results at once. This best practice ensures efficient processing and minimizes resource usage, as streaming commands reduce the amount of data before aggregation occurs. This approach leads to faster and more efficient searches. In contrast, the other options, such as using wildcards excessively or searching over all time, can lead to performance issues and excessive data processing.

An analyst is examining the logs for a web application??s login form. They see thousands of failed logon attempts using various usernames and passwords. Internet research indicates that these credentials may have been compiled by combining account information from
several recent data breaches.
Which type of attack would this be an example of?

1. A. Credential sniffing
2. B. Password cracking
3. C. Password spraying
4. D. Credential stuffing

Correct Answer: D
The scenario describes an attack where thousands of failed login attempts are made using various usernames and passwords, which is indicative of aCredential Stuffingattack. This type of attack involves using lists of stolen credentials (usernames and passwords) obtained from previous data breaches to attempt to gain unauthorized access to user accounts. Attackers take advantage of the fact that many users reuse passwords across multiple sites. UnlikePassword Spraying(which tries a few common passwords against many accounts) orPassword Cracking(which tries to guess or decrypt passwords), credential stuffing leverages large datasets of valid credentials obtained from other breaches.
Top of Form Bottom of Form

Which of the following is considered Personal Data under GDPR?

1. A. The birth date of an unidentified user.
2. B. An individual's address including their first and last name.
3. C. The name of a deceased individual.
4. D. A company's registration number.

Correct Answer: B
Under the General Data Protection Regulation (GDPR), Personal Data is any information relating to an identified or identifiable natural person. An individual's address, combined with their first and last name, clearly identifies a person, making it Personal Data under GDPR. The other options provided do not meet the GDPR criteria for Personal Data: the birth date of an unidentified user does not identify a person, the name of a deceased individual is not covered under GDPR, and a company??s registration number pertains to an entity rather than a natural person.
Top of Form Bottom of Form

A Cyber Threat Intelligence (CTI) team delivers a briefing to the CISO detailing their view of the threat landscape the organization faces. This is an example of what type of Threat Intelligence?

1. A. Tactical
2. B. Strategic
3. C. Operational
4. D. Executive

Correct Answer: B
A briefing delivered by a Cyber Threat Intelligence (CTI) team to a Chief Information Security Officer (CISO) detailing the overall threat landscape is an example ofStrategicThreat Intelligence. Strategic intelligence focuses on high-level analysis of broader trends, threat actors, and potential risks to the organization over time. It is designed to inform senior leadership and influence long-term security strategies and policies. This contrasts withTacticalintelligence, which deals with immediate threats and actionable information, andOperationalintelligence, which is more focused on the details of specific threat actors or campaigns.