Threat Hunter

Sample question 1

While reviewing network flow logs for a corporate office building, a threat hunter notices that a smart HVAC controller, which should only communicate with the building management vendor's cloud service over HTTPS, is also making repeated outbound connections to several internal file servers on ports normally used for SMB file sharing. The HVAC vendor has no documented reason for this behavior. What does this pattern most likely represent, and what should the hunter do?

1. A.Treat the traffic as expected vendor telemetry, since IoT devices are known to generate unusual traffic patterns that are generally not worth investigating on an individual basis.
2. B.Deprioritize the traffic pattern for now, since the connections stay within the internal network perimeter and are already covered by existing firewall and endpoint protections, making device-level investigation less urgent than external-facing alerts.
3. C.Treat the HVAC controller as a possible compromised pivot point reaching for internal file shares, isolate it from the rest of the network, and investigate it for signs of lateral movement or malware.
4. D.Conclude that the file servers must be misconfigured to accept HVAC connections, open a service ticket for the server team, and leave the HVAC controller's network access unchanged in the meantime.

Sample question 2

In 2026, a threat hunter at a mid-size law firm reviews cloud audit logs after a paralegal reports an unexpected folder-sharing notification. The logs show a third-party application named QuickScan PDF Tools was granted delegated Mail.Read and Files.ReadWrite.All permissions through a consent prompt the paralegal does not recall approving, and the app has since called the mailbox API to retrieve messages from three other partners' accounts, all without any sign-in attempt or password entry from those accounts. Applying knowledge of adversarial tactics, tools, and techniques, what is the most likely explanation and appropriate response?

1. A.The paralegal's account was compromised through credential stuffing, so the hunter should force a password reset only for the paralegal.
2. B.This is an illicit OAuth consent grant giving persistent API access without a password, so revoke the registration and invalidate its tokens for every affected account.
3. C.The three partners' accounts were breached through a supply-chain compromise of the PDF vendor's infrastructure, so the hunter should block the vendor's IP ranges at the firewall.
4. D.A phishing email delivered a malicious macro that established a foothold on the paralegal's endpoint, so the hunter should isolate that endpoint and run an antivirus scan.

Sample question 3

A threat intelligence feed the organization subscribes to issues an urgent bulletin describing a new campaign that targets Java-based CI/CD orchestration servers through an exposed management port, and lists eight IP addresses as active command-and-control infrastructure. The threat hunter must decide how to respond. The organization's CI/CD orchestrator runs on a different, non-Java platform, and ninety days of firewall logs show no inbound or outbound traffic involving any of the eight listed IPs. Applying threat intelligence principles and practices, what is the most appropriate next step?

1. A.Record the eight indicators in the threat intelligence platform for future correlation, note that the targeted platform and the observed traffic pattern do not match the organization's environment, and prioritize the bulletin lower than intelligence describing threats to the organization's actual technology stack.
2. B.Block the eight IP addresses at the network perimeter immediately and treat the bulletin as top priority, even though the campaign targets a different platform and no matching traffic has appeared, since any subscribed feed's command-and-control indicator should be acted on the same way regardless of relevance.
3. C.Discard the bulletin and do not record the eight indicators anywhere in the threat intelligence platform, since the campaign targets a different CI/CD platform and no matching traffic has appeared, and a mismatch on both counts means the intelligence has no further value worth preserving.
4. D.Forward the eight IP addresses to the network team for blocking, but make no changes to the CI/CD orchestrator's own exposed management interfaces, since the platform mismatch and ninety days without matching traffic together already confirm the environment was never exposed to this campaign.