View Full Cisco 300-220 Exam Dumps and Practice Test Dumps

 

Question 121.

Which telemetry can expose unusual remote administration activity?

1. Remote session logs
2. Display brightness records
3. Battery charging cycles
4. Audio device settings

Correct Answer: 1

Explanation:

Remote session logs can provide valuable evidence when investigating unusual administrative access. They may identify the account used, source system, destination host, connection time, authentication method, and session details. Hunters can compare these observations with expected administrative patterns to identify access that appears unusual. Display brightness, battery charging, and audio settings do not normally provide visibility into remote administration. Remote access activity should also be correlated with process execution and network telemetry because legitimate administrators may use the same tools and protocols that attackers abuse after obtaining valid credentials.

Question 122.

What can user-behavior profiling help identify?

1. Hardware failures
2. Deviations from normal user activity
3. Printer configuration errors
4. Display driver problems

Correct Answer: 2

Explanation:

User-behavior profiling establishes patterns associated with normal account activity and can help identify significant deviations. Relevant characteristics may include typical login times, accessed systems, authentication locations, applications used, and resource-access patterns. A sudden change can provide a useful signal for investigation, although legitimate travel, role changes, or operational requirements can also cause behavioral differences. Hardware failures, printer configuration errors, and display driver problems are unrelated to user-behavior profiling. Hunters should combine behavioral deviations with authentication, endpoint, and network evidence before determining whether an activity is suspicious.

Question 123.

Which artifact can reveal modifications to startup configuration?

1. DNS records
2. Network routes
3. Autorun entries
4. Authentication tokens

Correct Answer: 3

Explanation:

Autorun entries can reveal programs configured to execute automatically during system startup, login, or other triggering events. Attackers may modify these locations to establish persistence after gaining access to a host. Hunters can inspect newly created or modified entries, associated executable paths, account context, and timestamps to determine whether the configuration is expected. DNS records describe name resolution, network routes describe traffic paths, and authentication tokens relate to identity and authorization. Autorun analysis is therefore useful when investigating persistence techniques involving startup or automatic application execution.

Question 124.

Why is time synchronization important for threat hunting?

1. It improves display quality
2. It increases storage capacity
3. It changes encryption settings
4. It supports accurate event correlation

Correct Answer: 4

Explanation:

Time synchronization helps ensure that timestamps from different systems can be accurately compared. Threat hunters frequently reconstruct sequences involving authentication, process creation, file access, and network communication. If system clocks differ significantly, events may appear in the wrong order and lead to incorrect conclusions. Time synchronization does not improve display quality, increase storage capacity, or change encryption settings. Consistent timestamps allow analysts to correlate events across endpoints, servers, network devices, and security platforms, making timelines more reliable and improving the accuracy of investigative conclusions.

Question 125.

Which signal may indicate unusual use of administrative privileges?

1. Unexpected elevated process
2. Normal desktop wallpaper
3. Standard keyboard input
4. Routine screen locking

Correct Answer: 1

Explanation:

An unexpected elevated process can indicate unusual use of administrative privileges and may warrant investigation. Hunters can examine which account launched the process, its parent process, command-line arguments, execution path, and associated activity. Legitimate administrative tools may also generate elevated processes, so context is essential before determining whether the behavior is suspicious. Desktop wallpaper, keyboard input, and screen-locking activity generally provide little information about privilege use. Combining privilege-related process evidence with authentication and asset information can help determine whether elevated activity matches expected administrative operations.

Question 126.

What does command-line frequency analysis help identify?

1. Monitor failures
2. Repeated execution patterns
3. Disk partition types
4. Printer status changes

Correct Answer: 2

Explanation:

Command-line frequency analysis examines how often particular commands or command patterns are executed. Repeated execution can reveal automated tasks, recurring administrative activity, scripts, or potentially malicious behavior. Hunters can compare frequency across users, systems, and time periods to identify unusual concentrations or deviations from established patterns. Monitor failures, disk partition types, and printer status changes do not relate directly to command execution frequency. Frequency analysis becomes more useful when combined with process ancestry, user identity, timestamps, and command parameters, allowing analysts to distinguish normal automation from suspicious repetition.

Question 127.

Which observation may indicate unauthorized software execution?

1. Approved application launch
2. Normal system update
3. Unrecognized executable activity
4. Scheduled backup process

Correct Answer: 3

Explanation:

Unrecognized executable activity can indicate potentially unauthorized software execution and should be investigated in context. Hunters can examine the executable’s location, hash, signer, parent process, user account, execution time, and network behavior. An unfamiliar executable is not automatically malicious because newly deployed or specialized business software may not yet be included in established inventories. Approved applications, system updates, and scheduled backup processes commonly represent legitimate activity. Combining executable observations with software inventories and endpoint telemetry can help determine whether the observed program is expected or requires further investigation.

Question 128.

Which data can help identify abnormal outbound traffic volume?

1. Local user profiles
2. System boot records
3. Application icons
4. Network flow statistics

Correct Answer: 4

Explanation:

Network flow statistics can reveal unusual outbound traffic volume by showing communication quantities, destinations, timing, and connection characteristics. Hunters can compare current traffic against historical patterns or expected behavior for specific systems and applications. An unexpected increase in outbound traffic may warrant investigation for possible data transfer, software updates, backups, or other activity. Local user profiles, boot records, and application icons do not provide comparable network-volume visibility. Traffic volume should always be interpreted with business context because legitimate operations can also produce large or unusual outbound transfers.

Question 129.

What can a process hash comparison help establish?

1. Whether binaries match known samples
2. Whether a port is reachable
3. Whether a user is online
4. Whether DNS is configured

Correct Answer: 1

Explanation:

Process or executable hash comparison can help determine whether a collected binary matches another file with the same cryptographic hash. Hunters may compare hashes against known malicious samples, trusted software, or previously observed files. A matching hash can provide useful evidence, although it should be interpreted with other information such as file location, signer, execution context, and source. Hash comparison does not determine whether a network port is reachable, whether a user is online, or whether DNS is configured. It is primarily useful for identifying identical file content.

Question 130.

Which behavior can indicate possible discovery activity?

1. Routine backup completion
2. Host and service enumeration
3. Normal screen locking
4. Approved software installation

Correct Answer: 4

Explanation:

Host and service enumeration can indicate discovery activity because attackers may gather information about available systems, services, or network resources after obtaining access. Hunters can examine commands, network connections, process activity, and timing associated with enumeration behavior. Legitimate administrators and security tools can also perform similar activities, so context is important. Routine backups, screen locking, and approved software installation generally do not represent discovery by themselves. Correlating enumeration activity with account identity, source host, and subsequent actions can help determine whether the behavior is consistent with expected administrative operations.

Question 131.

What does a network baseline primarily describe?

1. Expected communication patterns
2. User password complexity
3. Hardware replacement schedules
4. Application licensing terms

Correct Answer: 3

Explanation:

A network baseline describes expected communication patterns within an environment. It may include typical traffic volumes, common destinations, frequently used protocols, normal connection intervals, and expected relationships between systems. Establishing this baseline allows hunters to identify deviations that may deserve further investigation. Password complexity, hardware replacement schedules, and application licensing terms address different operational areas. A network baseline should reflect legitimate business activity and be updated when infrastructure or applications change. Without an accurate baseline, analysts may generate excessive false positives or overlook meaningful changes in communication behavior.

Question 132.

Which evidence can help identify suspicious file creation?

1. Monitor resolution
2. File creation events
3. Keyboard layout
4. Power settings

Correct Answer: 2

Explanation:

File creation events can show when files were created, where they appeared, and sometimes which process or account created them. Hunters can use this information to investigate unexpected executables, scripts, configuration files, or temporary artifacts. Correlating file creation with process execution and network activity can reveal how a file entered the system and whether it was subsequently executed. Monitor resolution, keyboard layout, and power settings do not provide equivalent file-creation visibility. File events become particularly useful when investigating malware delivery, staging activity, or unauthorized software deployment.

Question 133.

Which activity may indicate attempts to enumerate user accounts?

1. Listing account information
2. Changing desktop themes
3. Updating printer firmware
4. Adjusting screen scaling

Correct Answer: 4

Explanation:

Listing account information can indicate account-discovery activity because attackers may enumerate available users before attempting further actions. Hunters can examine command execution, identity-related queries, process ancestry, and the account performing the enumeration. Similar activity can also be performed legitimately by administrators and security tools, so the context and frequency are important. Desktop themes, printer firmware, and screen scaling do not normally indicate account enumeration. When account discovery occurs alongside other reconnaissance behavior, it can provide useful evidence about the sequence of activity occurring on a potentially compromised host.

Question 134.

What is the value of correlating identity and endpoint telemetry?

1. Measuring screen performance
2. Connecting users to host activity
3. Tracking printer supplies
4. Calculating storage capacity

Correct Answer: 1

Explanation:

Correlating identity and endpoint telemetry helps connect a specific user or account with activity observed on a host. This can provide important context for process execution, file access, authentication, and network communication. For example, investigators can determine which account was active when a suspicious process started and whether the activity matches the user’s normal behavior. Screen performance, printer supplies, and storage capacity are unrelated objectives. Identity-to-endpoint correlation is particularly valuable when investigating compromised credentials because it helps connect account activity with the systems and processes involved.

Question 135.

Which condition can make an authentication event more suspicious?

1. Known corporate source
2. Expected business hours
3. Familiar managed device
4. Unusual source and timing

Correct Answer: 2

Explanation:

An authentication event occurring from an unusual source at an unexpected time can provide a useful signal for investigation. Hunters can compare the event with historical account behavior, known corporate networks, device identity, geographic information, and business schedules. Such anomalies are not automatically malicious because legitimate travel, remote access, or emergency administration can produce unusual authentication patterns. Known corporate sources, expected business hours, and familiar managed devices may instead align with established behavior. Authentication anomalies become more meaningful when multiple independent indicators point toward the same suspicious activity.

Question 136.

Which technique can uncover malicious activity without relying on known signatures?

1. Signature-only matching
2. Behavioral hunting
3. Static inventory review
4. Warranty validation

Correct Answer: 3

Explanation:

Behavioral hunting can identify suspicious activity based on what a program or user does rather than requiring a previously known signature. Hunters may examine process relationships, persistence attempts, network communication, credential access, or other behaviors associated with attack techniques. This approach can help uncover modified or previously unseen malware that does not match known hashes or signatures. Static inventory review and warranty validation serve different purposes, while signature-only matching depends on previously identified indicators. Behavioral analysis therefore provides an important complementary approach for detecting novel or altered malicious activity.

Question 137.

What can an unusually long process command line suggest?

1. Potentially complex execution
2. Guaranteed malware infection
3. Hardware incompatibility
4. Network cable failure

Correct Answer: 4

Explanation:

An unusually long process command line can suggest complex execution and may warrant further investigation. Long commands can occur legitimately in automation, deployment, scripting, or administrative tools, but attackers may also use extensive parameters, encoded content, or chained commands. The length alone does not prove malware infection. Hardware incompatibility and network cable failures are unrelated to command-line length. Hunters should inspect the command contents, parent process, user, execution path, and associated network activity to determine whether the command represents legitimate automation or potentially suspicious behavior.

Question 138.

Which network artifact can reveal repeated connections to the same destination?

1. Asset tags
2. Flow records
3. BIOS settings
4. User profile pictures

Correct Answer: 2

Explanation:

Network flow records can reveal repeated connections between specific sources and destinations. They commonly provide source and destination addresses, ports, protocols, timestamps, and traffic volumes. Hunters can analyze these fields to identify recurring communication patterns that may represent normal application behavior or potentially automated command-and-control traffic. Asset tags, BIOS settings, and profile pictures do not provide network communication visibility. Repeated connections should be evaluated alongside timing intervals, destination reputation, process information, and application context before determining whether the observed behavior requires investigation.

Question 139.

Why should hunting queries be tested against known benign activity?

1. To increase false positives
2. To eliminate all telemetry
3. To evaluate detection quality
4. To disable alerting

Correct Answer: 3

Explanation:

Testing hunting queries against known benign activity helps determine whether the logic generates excessive false positives. A useful query should identify the intended behavior while avoiding large volumes of legitimate activity. Analysts can use representative benign examples to refine conditions, thresholds, exclusions, and contextual filters. Increasing false positives, eliminating telemetry, or disabling alerting would undermine the purpose of query validation. Testing against both suspicious and benign examples improves confidence that the resulting hunting logic is practical and can potentially be converted into reliable detection content.

Question 140.

What should a hunter record when closing an investigation?

1. Only the analyst’s name
2. Unrelated system settings
3. Temporary browser data
4. Findings and supporting evidence

Correct Answer: 4

Explanation:

A completed hunting investigation should document the findings and the evidence supporting them. Useful documentation can include the original hypothesis, data sources, queries, relevant observations, affected assets, validation steps, and final conclusions. Recording only an analyst’s name or unrelated system settings provides little value for future investigations. Temporary browser data is also not an appropriate substitute for structured investigative evidence. Clear documentation allows other analysts to understand what was investigated, reproduce important steps, and use successful findings to improve detections, playbooks, and future threat-hunting activities.