300-220 Actual Questions Answers PDF 100% Cover Real Exam Questions
300-220 Exam questions and answers
NEW QUESTION # 79
During the Threat Hunting Process, what is the goal of the Data Analysis phase?
- A. Verify formed patterns
- B. Identify anomalies
- C. Gather more data
- D. Formulate hypotheses
Answer: B
NEW QUESTION # 80
Why is it important to document and communicate findings during the threat hunting process?
- A. To share knowledge and improve overall security posture
- B. To ensure that all findings are thoroughly investigated
- C. To keep sensitive information confidential
- D. To maintain compliance with industry regulations
Answer: A
NEW QUESTION # 81
Which of the following is an example of a passive threat hunting technique?
- A. Penetration testing
- B. Packet capture analysis
- C. Intrusion detection system (IDS)
- D. Event correlation
Answer: B
NEW QUESTION # 82
What is the purpose of using sandboxing as a threat hunting technique?
- A. To monitor network traffic
- B. To analyze log files
- C. To conduct penetration testing
- D. To analyze malware behavior in a controlled environment
Answer: D
NEW QUESTION # 83
Why is collaboration with other security teams important in threat hunting?
- A. It is not important, as threat hunting is an individual effort.
- B. Collaboration increases the risk of data breaches.
- C. Collaboration allows for sharing of information and resources to better detect and respond to threats.
- D. Collaboration slows down the threat hunting process.
Answer: C
NEW QUESTION # 84
Which of the following is NOT a common challenge in Threat Actor Attribution?
- A. Abundance of threat intelligence
- B. False flag operations
- C. Lack of skilled personnel
- D. Limited access to relevant data
Answer: A
NEW QUESTION # 85
What is the primary objective of the investigation phase in the threat hunting process?
- A. Develop new strategies
- B. Analyze collected data
- C. Validate hypotheses
- D. Collect more data
Answer: B
NEW QUESTION # 86
What is the primary goal of threat hunting outcomes?
- A. To proactively detect and respond to threats
- B. To create awareness about cybersecurity best practices
- C. To identify and mitigate all potential threats
- D. To compile a list of known security vulnerabilities
Answer: A
NEW QUESTION # 87
What is the purpose of leveraging threat intelligence feeds in threat hunting?
- A. To remove malware from endpoints
- B. To conduct social engineering attacks
- C. To monitor physical security
- D. To enrich security logs with information about known threats
Answer: D
NEW QUESTION # 88
Which threat hunting technique involves creating custom YARA rules to detect specific malware families?
- A. Threat intelligence sharing
- B. Network traffic analysis
- C. Signature-based detection
- D. Log analysis
Answer: C
NEW QUESTION # 89
A SOC team must prepare for a new phishing campaign that tricks users into clicking a malicious URL to download a file. When the file executes, it creates a Windows process that harvests user credentials. The team must configure the SIEM tool to receive an alert if a suspicious process is detected. Which two rules must the team create in the SIEM tool? (Choose two.)
- A. Rule that detects processes in nonstandard file paths
- B. Rule that detects changes in process ownership
- C. Rule that detects processes created by the users
- D. Rule that detects common processes that have modified names
- E. Rule that detects changes in process startup time
Answer: A,D
Explanation:
The correct answers areB. Processes in nonstandard file pathsandC. Common processes with modified names. These two detection rules are highly effective for identifyingmalicious processes spawned by phishing-delivered malware.
Phishing payloads commonly drop executables intononstandard directoriessuch as AppData, Temp, Downloads, or user profile subfolders. Legitimate Windows binaries rarely execute from these locations.
Monitoring for process execution from such paths is a proven technique for detecting malware loaders, credential stealers, and post-exploitation tooling.
Additionally, attackers frequentlymasquerade malware as legitimate processesby using slightly modified names, such as lsasss.exe, svch0st.exe, or expl0rer.exe. These tactics are designed to evade casual inspection and basic allowlisting. Detecting common Windows process names with anomalies-such as incorrect spelling, unexpected parent processes, or abnormal execution paths-is a high-fidelity behavioral signal.
Option A is too broad; nearly all processes are created by users directly or indirectly, making it noisy. Option D (process ownership changes) and Option E (startup time changes) are less relevant to detecting credential- harvesting processes at execution time and may miss the initial malicious activity.
From a threat hunting and detection engineering perspective, optionsB and Calign withMITRE ATT&CK - Defense Evasion and Credential Accesstechniques. These rules focus onbehavioral detection, not static indicators, making them resilient against attacker variation.
In short, detectingwhere a process runs fromandwhat it pretends to beprovides strong coverage against phishing-delivered malware, makingB and Cthe correct and professionally validated choices.
NEW QUESTION # 90
Which of the following is a key step in threat modeling techniques?
- A. Conducting user acceptance testing
- B. Developing secure code
- C. Identifying potential threats
- D. Performing vulnerability scans
Answer: C
NEW QUESTION # 91
Memory-resident attacks can be analyzed using which tool?
- A. Nmap
- B. Nessus
- C. Wireshark
- D. Volatility
Answer: D
NEW QUESTION # 92
Which of the following is an indicator commonly used for threat actor attribution?
- A. User agent string
- B. IP address
- C. Geolocation
- D. Malware hash
Answer: B
NEW QUESTION # 93
Which step in the threat hunting process involves refining the initial plan based on feedback and experience?
- A. Threat monitoring
- B. Reporting
- C. Strategy refinement
- D. Validation
Answer: C
NEW QUESTION # 94
What role does continuous monitoring play in the Threat Hunting Process?
- A. It helps in identifying potential threats before they escalate
- B. It slows down the overall process
- C. It is not necessary
- D. It is only important during the data collection phase
Answer: A
NEW QUESTION # 95
A security analyst receives an alert that host A, which has an IP address of 192.168.5.39, has a new browser extension installed. During an investigation of the SIEM tool logs, the analyst discovers that host A made continuous TCP connections to an IP address of 1.25.241.8 via TCP port 80. The 1.25.241.8 IP address is categorized as a C2 server. Which action should the analyst take to mitigate similar connections in the future?
- A. Use antivirus software to quarantine suspicious files automatically.
- B. Configure a browser extension deny list.
- C. Use IDS to detect and avoid similar connections.
- D. Use Deep Packet Inspection to block malicious domains.
Answer: D
Explanation:
The correct answer isUse Deep Packet Inspection (DPI) to block malicious domains. The key detail in this scenario is that the endpoint is makingcontinuous outbound TCP connections to a known Command-and- Control (C2) server over port 80, which strongly indicates active malware beaconing or payload retrieval.
Deep Packet Inspection enables security controls-such as next-generation firewalls or network security analytics platforms-to inspectapplication-layer content, including HTTP headers, URLs, domains, and payload characteristics. This allows defenders to block C2 communicationbased on domain names, URL patterns, or behavioral signatures, even if attackers change IP addresses. Since C2 infrastructure is frequently rotated, IP-based blocking alone is insufficient for long-term mitigation.
Option A (browser extension deny list) may help prevent a specific initial infection vector, but it does not addresspost-compromise C2 traffic, especially if malware communicates independently of the browser.
Option B (antivirus quarantine) is reactive and limited by signature coverage; modern malware often evades AV detection. Option D (IDS) can detect similar connections but typically does notblocktraffic unless integrated with an IPS or firewall, making it less effective for mitigation.
From a professional threat hunting and SOC standpoint, blocking C2 communication at thenetwork layer using DPIis a high-impact defensive control. It disrupts attacker command channels, prevents data exfiltration, and buys time for endpoint remediation and forensic investigation.
This aligns withMITRE ATT&CK - Command and Control (TA0011)mitigation strategies and reflects a mature security posture:detect at the endpoint, disrupt at the network. Therefore, optionCis the most effective action to mitigate similar connections in the future.
NEW QUESTION # 96
......
ExamCost 300-220 Exam Practice Test Questions: https://www.examcost.com/300-220-practice-exam.html
Pass 300-220 Exam Info and Free Practice Test: https://drive.google.com/open?id=1RbVkeENlqLtlE1Vc-4IhKmrNS8rc3Ax9
