View Full Cisco 300-220 Exam Dumps and Practice Test Dumps

Question 41.

Which security control helps detect unauthorized changes to critical files?

1. Network segmentation
2. File integrity monitoring
3. Load balancing
4. Address translation

Correct Answer: 2

Explanation:

File integrity monitoring detects changes to monitored files, directories, or configuration objects. It can identify modifications, creations, deletions, or other changes that may indicate unauthorized activity. Security teams can use this capability to monitor sensitive system files, application configurations, and other critical resources. Network segmentation separates network zones, load balancing distributes application traffic, and address translation modifies network addressing. File integrity monitoring is especially useful when attackers attempt to establish persistence or modify security configurations. Analysts should correlate detected changes with authorized maintenance activity to distinguish legitimate updates from potentially malicious modifications.

Question 42.

What is the primary purpose of threat intelligence correlation?

1. Reduce disk capacity
2. Replace endpoint security
3. Disable unused accounts
4. Connect related threat information

Correct Answer: 4

Explanation:

Threat intelligence correlation connects related pieces of information to provide a more complete understanding of a threat. An analyst might correlate an IP address with a domain, malware family, campaign, threat actor, or observed attack technique. This relationship-based analysis can reveal patterns that would remain hidden when indicators are considered individually. Correlation does not replace endpoint security or disable accounts, and it is unrelated to reducing disk capacity. Strong correlation can help hunters develop better hypotheses, prioritize investigations, and understand whether multiple observations may belong to the same adversary activity.

Question 43.

Which technique can identify unusual processes running on an endpoint?

1. Process enumeration
2. Cable testing
3. Printer inspection
4. Asset disposal

Correct Answer: 1

Explanation:

Process enumeration provides a view of processes currently running on an endpoint and can help identify unexpected applications, suspicious execution paths, or unusual process relationships. Hunters can compare observed processes with known software inventories and expected administrative activity. A process that is unfamiliar or executing from an unusual location may warrant further examination, although unfamiliarity alone does not establish maliciousness. Cable testing, printer inspection, and asset disposal are unrelated operational activities. Process enumeration becomes more valuable when combined with command-line information, user context, file metadata, and network connections.

Question 44.

Which factor is important when evaluating threat intelligence reliability?

1. Monitor resolution
2. Cable length
3. Source credibility
4. Keyboard type

Correct Answer: 3

Explanation:

Source credibility is an important factor when evaluating threat intelligence. Analysts should consider who produced the information, how it was collected, whether the source has a reliable history, and whether supporting evidence is available. Intelligence from an unknown or unreliable source may require additional validation before being used for detection or hunting. Monitor resolution, cable length, and keyboard type have no meaningful role in assessing intelligence reliability. Analysts should also consider freshness, relevance, confidence, and corroboration when determining whether intelligence is appropriate for a specific investigation.

Question 45.

Which activity searches historical logs for newly identified indicators?

1. Vulnerability remediation
2. Retrospective hunting
3. Password rotation
4. Hardware auditing

Correct Answer: 2

Explanation:

Retrospective hunting searches previously collected telemetry for indicators or behaviors that have become relevant after the data was originally generated. For example, if a new malicious domain is identified today, analysts can search historical DNS, proxy, endpoint, or network records to determine whether systems previously interacted with it. This approach can uncover earlier evidence of compromise that automated detections did not identify at the time. Vulnerability remediation, password rotation, and hardware auditing address different security or administrative requirements and do not specifically describe historical threat hunting.

Question 46.

What does an IOC primarily represent?

1. A security control
2. An incident response team
3. A network architecture
4. Evidence associated with compromise

Correct Answer: 4

Explanation:

An Indicator of Compromise, or IOC, is an observable artifact that may provide evidence of malicious activity or compromise. Examples can include suspicious file hashes, domains, IP addresses, email characteristics, or other artifacts associated with known attacks. An IOC does not automatically prove that a system is compromised because many indicators require contextual validation. Security controls, network architectures, and incident response teams are broader defensive concepts. Threat hunters can use IOCs as starting points for searches and then correlate them with behavioral and environmental evidence.

Question 47.

Which hunting method uses known attacker behavior as its starting point?

1. Behavior-based hunting
2. Hardware inventory
3. Configuration backup
4. Capacity forecasting

Correct Answer: 1

Explanation:

Behavior-based hunting begins with known or suspected adversary behavior and searches telemetry for evidence of that behavior. Instead of relying only on a specific file hash or IP address, analysts may search for patterns such as suspicious scripting, credential access, remote execution, or unusual persistence mechanisms. This approach can remain useful even when attackers change their specific tools or infrastructure. Hardware inventory, configuration backup, and capacity forecasting serve different operational purposes. Behavior-based hunting is particularly valuable when defenders want to identify activity that shares characteristics with known adversary techniques.

Question 48.

Which security telemetry can reveal suspicious DNS query frequency?

1. Endpoint inventory
2. DNS logs
3. Hardware diagnostics
4. User directory

Correct Answer: 2

Explanation:

DNS logs provide visibility into domain-resolution requests and their timing. Analysts can examine query frequency, requested domains, source hosts, response information, and patterns that may indicate suspicious behavior. Repeated queries to unusual domains or highly regular query intervals can warrant further investigation, although legitimate applications can also produce frequent DNS activity. Endpoint inventory describes assets, hardware diagnostics describe equipment health, and user directories provide identity information. DNS telemetry becomes more useful when correlated with endpoint processes and network connections to determine which application or system generated the observed requests.

Question 49.

What is the purpose of a threat hunting playbook?

1. Guide repeatable investigations
2. Increase storage capacity
3. Replace all analysts
4. Configure physical cabling

Correct Answer: 1

Explanation:

A threat hunting playbook provides structured guidance for conducting a particular type of investigation. It can define the hypothesis, required data sources, hunting queries, investigative steps, validation criteria, and recommended follow-up actions. Playbooks help make hunting activities more consistent and repeatable, particularly across teams or shifts. They do not replace analysts or configure physical infrastructure. A well-maintained playbook can also incorporate lessons from previous investigations and be updated when adversary behaviors, telemetry sources, or detection capabilities change.

Question 50.

Which activity maps observed events to adversary objectives?

1. Log compression
2. Asset tagging
3. ATT&CK mapping
4. Storage provisioning

Correct Answer: 3

Explanation:

ATT&CK mapping relates observed behaviors to documented adversary tactics, techniques, and sub-techniques. This helps analysts understand what an adversary may be attempting to accomplish and how observed activity fits within a broader attack sequence. For example, authentication anomalies may be mapped to relevant credential-related behavior, while suspicious remote execution can be associated with an appropriate execution or lateral-movement technique. Log compression, asset tagging, and storage provisioning are administrative activities and do not provide the same behavioral mapping capability.

Question 51.

Which practice helps preserve evidence during a security investigation?

1. Controlled evidence handling
2. Immediate log deletion
3. Untracked system changes
4. Unverified data copying

Correct Answer: 1

Explanation:

Controlled evidence handling helps preserve the integrity and usefulness of information collected during an investigation. Analysts should document collection activities, maintain appropriate access controls, preserve original evidence when required, and record relevant timestamps and handling details. Immediately deleting logs can destroy valuable investigative information, while untracked changes and unverified copying can make evidence difficult to trust. Proper evidence handling supports repeatability and helps investigators demonstrate how information was collected and analyzed. Organizations should follow their established forensic, legal, and incident-response procedures when handling sensitive evidence.

Question 52.

Which activity can reveal an attacker attempting to discover available services?

1. File compression
2. Port scanning analysis
3. Password hashing
4. Backup verification

Correct Answer: 2

Explanation:

Port scanning analysis can reveal attempts to discover accessible network services on hosts. An attacker may probe multiple ports or systems to determine which services are available and potentially identify opportunities for further exploitation. Hunters can examine network flows, firewall events, connection attempts, and destination-port patterns to identify unusual scanning behavior. File compression, password hashing, and backup verification serve unrelated purposes. Scanning activity can also originate from legitimate security tools, so analysts should consider the source system, timing, scope, and organizational context before treating observed scanning as malicious.

Question 53.

Which characteristic is associated with a useful hunting hypothesis?

1. Specific and testable
2. Completely undefined
3. Unrelated to telemetry
4. Impossible to validate

Correct Answer: 1

Explanation:

A useful hunting hypothesis should be specific enough to test against available evidence. It should describe a suspected behavior, threat scenario, or activity that analysts can investigate using defined data sources. A vague hypothesis makes it difficult to determine what should be searched or what evidence would support or contradict the assumption. A hypothesis should also be realistic for the organization’s environment and telemetry capabilities. By making hypotheses specific and testable, hunters can measure results, document findings, refine investigations, and turn successful hunts into reusable detection or hunting content.

Question 54.

Which technology can aggregate security telemetry for centralized analysis?

1. SIEM
2. BIOS
3. UPS
4. KVM

Correct Answer: 1

Explanation:

A Security Information and Event Management system, or SIEM, aggregates and analyzes security-related events from multiple sources. It can collect logs from endpoints, servers, network devices, applications, identity systems, and other infrastructure. Centralizing telemetry makes searching and correlation easier and can support alerting, investigation, reporting, and threat hunting. BIOS provides firmware functionality, a UPS supplies backup power, and a KVM allows users to control multiple computers. SIEM platforms can therefore serve as an important analytical foundation for security operations and threat-hunting activities.

Question 55.

What can endpoint telemetry reveal about suspicious application behavior?

1. Process ancestry
2. Office furniture
3. Cable topology
4. Asset depreciation

Correct Answer: 1

Explanation:

Endpoint telemetry can reveal process ancestry, showing which process launched another process. This relationship can provide important context during investigations because unexpected parent-child combinations may indicate script execution, exploitation, or other suspicious behavior. For example, an unusual application launching a command interpreter could warrant additional analysis. Office furniture, cable topology, and asset depreciation are unrelated to endpoint application behavior. Process ancestry should be examined alongside command-line parameters, executable locations, user accounts, timestamps, and network activity to determine whether the execution chain represents legitimate activity or a potential threat.

Question 56.

Which threat intelligence element describes when an intelligence item was observed?

1. Timestamp
2. Encryption key
3. File permission
4. Screen setting

Correct Answer: 1

Explanation:

A timestamp records when an event or intelligence item was observed or generated. Temporal information is important because threat intelligence can change in relevance over time, and analysts need to understand when an indicator was active or reported. A timestamp also allows investigators to correlate intelligence with internal events and construct timelines. Encryption keys, file permissions, and screen settings serve different technical purposes. When using threat intelligence, analysts should consider both the observation time and the age of the underlying information because infrastructure and indicators can become outdated.

Question 57.

Which activity helps identify whether an IP address is associated with known malicious infrastructure?

1. Threat intelligence enrichment
2. Disk partitioning
3. Firmware updating
4. Memory testing

Correct Answer: 1

Explanation:

Threat intelligence enrichment can provide additional information about an IP address, including reputation data, historical observations, associated domains, known campaigns, or other threat relationships. This information can help analysts decide whether an observed connection deserves further investigation. An IP address should not automatically be classified as malicious solely because an intelligence source lists it; analysts should consider source confidence, observation age, ownership, and the context in which the address was contacted. Disk partitioning, firmware updating, and memory testing do not provide the same threat-context information.

Question 58.

Which event may indicate possible credential theft?

1. Routine software update
2. Successful scheduled backup
3. Unexpected credential store access
4. Normal printer activity

Correct Answer: 3

Explanation:

Unexpected access to credential stores can be a potential indicator of credential theft activity. Attackers may attempt to obtain stored passwords, authentication material, tokens, or other credentials to expand access within an environment. However, legitimate applications and administrative tools may also access credential-related resources, so analysts should investigate the initiating process, user, timing, destination, and surrounding activity. Routine software updates, scheduled backups, and printer operations may be normal activities. Correlating credential-store access with process telemetry and authentication events can provide stronger evidence about the nature of the behavior.

Question 59.

What is the purpose of validating a threat intelligence indicator?

1. Confirm relevance
2. Increase CPU speed
3. Expand disk capacity
4. Modify screen settings

Correct Answer: 1

Explanation:

Indicator validation determines whether an intelligence item is relevant, trustworthy, and applicable to the investigation. An indicator may be outdated, incorrectly reported, shared by legitimate services, or unrelated to the organization’s environment. Analysts can validate indicators by checking multiple intelligence sources, historical observations, internal telemetry, ownership information, and contextual details. Validation helps prevent unnecessary investigations and inaccurate conclusions. CPU speed, disk capacity, and screen settings have no role in determining whether a cybersecurity indicator is relevant to a particular hunting investigation.

Question 60.

Which outcome can result from converting a successful hunt into a detection?

1. Reduced visibility
2. Automated future identification
3. Deleted historical data
4. Removed security telemetry

Correct Answer: 2

Explanation:

A successful threat hunt can reveal a behavior that is suitable for conversion into an automated detection. By turning a validated hunting pattern into detection logic, security teams may identify similar activity more quickly in the future without requiring the same manual investigation each time. Detection engineering can involve creating rules, analytics, correlation logic, or other automated mechanisms based on the validated behavior. This does not mean manual hunting becomes unnecessary, because attackers can change their techniques and new hypotheses will continue to require investigation.