Free 300-220 sample questions

Correct answer: Establishing baseline profiles of administrative script execution and analyzing routine command-line and script-block telemetry to detect anomalous TTP behaviors.

The Pyramid of Pain reflects both the pain caused to an attacker when indicators are denied and the detection difficulty for defenders. When an attacker abuses a legitimate, built-in administrative utility like PowerShell without dropping custom files on disk, static file hashes (SHA-1/MD5) and binary YARA signatures are ineffective. Advancing up the Threat Hunting Maturity Model to hunt at the Host Artifacts and TTPs layers requires collecting granular host telemetry (such as PowerShell script-block and command-line logs) and distinguishing malicious procedures from legitimate administrative baselines.

Correct answer: Expand telemetry collection to include HTTP proxy headers, endpoint registry modifications, and Windows authentication logs, develop behavioral data analysis procedures targeting network/host artifacts and TTPs, and automate validated hunting routines into continuous detections.

Advancing through the phases of the Threat Hunting Maturity Model requires expanding routine data collection from basic network connection and antivirus alerts to comprehensive host and protocol telemetry, enabling hunters to operate at the top layers of the Pyramid of Pain. Collecting HTTP proxy headers exposes the distinctive User-Agent string (Network Artifact), registry telemetry exposes the persistence key (Host Artifact), and Windows authentication logs expose Pass-the-Hash behavior (TTPs). Finally, highest-maturity hunting programs automate and operationalize proven data analysis procedures into continuous detection rules so hunters can focus on new hypotheses rather than repeating manual searches.

Correct answer: Cycle back to the Define / refine step to adjust the hypothesis, scope, data sources, or analysis techniques, or update the hunting backlog for follow-up.

In Phase II (Hunt) of the TaHiTI methodology, hunters move between two core steps: `Define / refine` and `Execute`. The final activity of `Execute` is hypothesis validation, which yields one of three outcomes: `proven`, `disproven`, or `inconclusive`. When omissions in data sources, scope, or techniques are discovered during execution—or when further iterations are needed—the methodology specifies cycling back to `Define / refine` to adjust the investigation parameters or updating the hunting backlog with follow-up abstracts before moving to Phase III (Finalize). flowchart LR subgraph P1["Phase I: Initiate"] S1[Trigger] --> S2[Investigation Abstract] S2 --> S3[Hunting Backlog] end subgraph P2["Phase II: Hunt"] S4[Define / Refine] --> S5[Execute & Validate Hypothesis] S5 -->|Iterate / Refine| S4 end subgraph P3["Phase III: Finalize"] S6[Document Findings & Handover] end S3 --> S4 S5 -->|Update Backlog| S3 S5 -->|Proven / Disproven / Concluded| S6

Correct answers: MITRE CAPEC provides a public catalog of common attack patterns showing how adversaries exploit weaknesses in applications and other cyber-enabled capabilities.; TaHiTI integrates threat intelligence into a three-phase structured hunting process and uses the Diamond Model's four features to enrich TTP matches.

MITRE CAPEC (Common Attack Pattern Enumeration and Classification) catalogs common attack patterns to help analysts and architects understand how adversaries exploit weaknesses in software applications and cyber-enabled capabilities. TaHiTI (Targeted Hunting integrating Threat Intelligence) structures threat hunting into three phases (Initiate, Hunt, Finalize) and uses the four features of the Diamond Model (actors, methods/capabilities, infrastructure, victims) to enrich TTP matches.

TaHiTI is a structured, intelligence-driven threat hunting methodology consisting of three phases (Initiate, Hunt, Finalize) and six steps, incorporating the Diamond Model (actors, methods/capabilities, infrastructure, victims) when enriching TTP matches. By contrast, MITRE D3FEND (not PASTA) is MITRE's knowledge base of defensive countermeasures, MITRE ATT&CK focuses on adversary tactics and techniques rather than CVSS software scoring, and TaHiTI focuses on the top three layers of the Pyramid of Pain rather than the bottom three.

Correct answer: True

In MITRE ATT&CK, tactics represent the "why" of an ATT&CK technique—the adversary's tactical goal or contextual reason for performing an action, identified by codes such as TA0001 (Initial Access) and TA0011 (Command and Control). Techniques represent "how" an adversary achieves that tactical goal, and the MITRE ATT&CK Navigator tool allows analysts and hunters to map, compare, and link attack techniques to known APT groups.

Correct answer: Unstructured threat hunting, which is data-driven and searches for anomalies in available data without starting from a hypothesis.

Unstructured threat hunting is a data-driven approach in which an analyst sifts through available data sources searching for anomalies without starting from a predefined hypothesis or following a set path. In contrast, structured threat hunting is hypothesis-based: a trigger initiates a hunting investigation abstract, a testable hypothesis is formulated first, and the hunt is scoped and executed toward a specific goal.