View Full Cisco 300-220 Exam Dumps and Practice Test Dumps

 

Question 161.

Which artifact can reveal recently mounted removable storage?

1. Browser history
2. DNS cache
3. Display profiles
4. Device connection records

Correct Answer: 4

Explanation:

Device connection records can reveal when removable storage devices were connected to an endpoint. This information can support investigations involving unauthorized data transfer, suspicious file access, or the introduction of unknown software. Hunters can examine device identifiers, connection times, associated users, and subsequent file activity to determine whether removable media usage was expected. Browser history, DNS cache, and display profiles do not directly provide removable-device visibility. Device telemetry becomes more valuable when correlated with file-access events and process activity, allowing analysts to establish what occurred after a removable device was connected.

Question 162.

What should a hunter compare against a known-good endpoint baseline?

1. Only screen resolution
2. System configuration changes
3. Printer paper usage
4. Mouse sensitivity

Correct Answer: 2

Explanation:

System configuration changes can be compared against a known-good endpoint baseline to identify unexpected modifications. Relevant comparisons may include services, startup mechanisms, installed applications, security settings, scheduled tasks, and other configuration elements. A baseline provides a reference point for identifying changes that may deserve investigation. Screen resolution, printer usage, and mouse sensitivity are generally unrelated to security-focused configuration analysis. Baselines should be maintained carefully because legitimate software updates and administrative changes can modify endpoint configurations. Context is therefore essential before treating a difference as suspicious.

Question 163.

Which behavior can indicate possible credential dumping activity?

1. Accessing protected credential stores
2. Updating display drivers
3. Synchronizing system time
4. Printing routine documents

Correct Answer: 1

Explanation:

Accessing protected credential stores can be a significant hunting signal because attackers may attempt to obtain passwords, authentication material, or other secrets after compromising an endpoint. Hunters can investigate which process accessed the protected resource, which account initiated the activity, and whether related processes or network connections appeared around the same time. Display-driver updates, system-time synchronization, and routine printing generally do not indicate credential-access behavior. Credential-store access should still be validated carefully because legitimate security tools and administrative processes may perform similar operations.

Question 164.

Why can network segmentation context help threat hunters?

1. It changes endpoint passwords
2. It increases CPU capacity
3. It clarifies expected communication paths
4. It removes historical telemetry

Correct Answer: 3

Explanation:

Network segmentation context helps hunters understand which communication paths are expected between different network zones. If a host communicates with a system or service that should normally be isolated from it, the relationship may warrant investigation. Segmentation information can therefore provide important context when evaluating lateral movement, unauthorized access, or unusual internal connections. Changing passwords, increasing CPU capacity, and removing telemetry do not provide this analytical benefit. Understanding network architecture allows hunters to distinguish legitimate cross-segment communication from connections that appear inconsistent with established security boundaries.

Question 165.

Which evidence can indicate unusual execution from a temporary directory?

1. DNS response timing
2. File execution path
3. Monitor power state
4. Printer configuration

Correct Answer: 2

Explanation:

The file execution path can reveal where an executable originated and where it was launched from. Execution from temporary directories can sometimes be significant because attackers and malicious installers may place payloads in temporary locations before execution. However, legitimate software installers and applications can also use temporary directories, so the path should not be treated as proof of malicious activity. Hunters can combine execution-path information with file hashes, process ancestry, user context, timestamps, and network activity. DNS timing, monitor state, and printer configuration do not provide equivalent execution-path visibility.

Question 166.

Which activity is most useful for identifying unusual account access times?

1. Reviewing authentication timestamps
2. Checking screen brightness
3. Inspecting audio settings
4. Comparing printer models

Correct Answer: 1

Explanation:

Authentication timestamps provide direct evidence about when account access occurred. Hunters can compare login times against the user’s normal working patterns, expected schedules, known maintenance windows, and historical activity. Unusual access times may provide a useful signal when combined with other anomalies, although legitimate remote work, travel, automation, and emergency administration can also produce unusual timing. Screen brightness, audio settings, and printer models do not provide meaningful authentication timing information. Reviewing timestamps alongside source addresses and device identity can provide stronger context for determining whether an access event deserves investigation.

Question 167.

What can a sudden increase in outbound DNS queries suggest?

1. Reduced disk space
2. Hardware degradation
3. Automated or unusual lookup activity
4. Printer configuration drift

Correct Answer: 3

Explanation:

A sudden increase in outbound DNS queries can indicate automated or otherwise unusual lookup activity. Malware may generate frequent queries as part of discovery, command-and-control communication, or domain-generation behavior. However, legitimate applications, software updates, browsers, and cloud services can also create bursts of DNS activity. Hunters should therefore examine the queried domains, request frequency, requesting process, timestamps, and associated network connections. Reduced disk space, hardware degradation, and printer configuration changes do not explain DNS-query volume. Combining DNS telemetry with endpoint context can help determine whether the increase represents expected application behavior or suspicious activity.

Question 168.

Which source can help identify unauthorized local account creation?

1. Display event logs
2. File compression records
3. Account-management events
4. Browser cache entries

Correct Answer: 3

Explanation:

Account-management events can reveal when local accounts are created, modified, enabled, or disabled. Hunters can examine the account name, creating user, timestamp, host, and associated administrative activity to determine whether a new account was expected. Attackers may create accounts to maintain access or establish additional privileges after compromising a system. Display logs, file compression records, and browser cache entries do not directly provide account-management visibility. New-account events should be correlated with authentication and process telemetry to understand whether the change was part of legitimate administration or potentially unauthorized activity.

Question 169.

What can certificate information reveal during infrastructure analysis?

1. Related infrastructure clues
2. Keyboard configuration
3. Disk partition layout
4. User display preferences

Correct Answer: 1

Explanation:

Certificate information can provide useful infrastructure clues during threat hunting. Analysts may examine certificate subjects, issuers, validity periods, fingerprints, and other characteristics to identify relationships between domains or systems. These relationships can support infrastructure pivoting when investigating suspicious services. Certificate information does not directly describe keyboard configuration, disk partition layouts, or display preferences. Certificate-based relationships should be validated carefully because legitimate organizations and hosting providers may reuse certificates or infrastructure across multiple systems. Combining certificate observations with DNS, network, and hosting information can strengthen infrastructure analysis.

Question 170.

Which observation can help identify abnormal data staging?

1. Routine system startup
2. Unusual aggregation of sensitive files
3. Normal password expiration
4. Standard screen locking

Correct Answer: 2

Explanation:

Unusual aggregation of sensitive files can indicate possible data staging before transfer or exfiltration. Hunters may look for large collections of documents being copied into a single directory, archive location, temporary folder, or other unusual storage area. This behavior can also have legitimate explanations, such as backups or administrative file management, so additional context is necessary. Routine startup, password expiration, and screen locking do not normally indicate data staging. Correlating file activity with process execution, user identity, archive creation, and subsequent outbound traffic can help determine whether the behavior requires investigation.

Question 171.

What is a useful purpose of a threat-hunting playbook?

1. Replace all security tools
2. Document repeatable investigative steps
3. Increase endpoint storage
4. Modify hardware settings

Correct Answer: 2

Explanation:

A threat-hunting playbook documents repeatable investigative steps for analyzing a particular behavior, technique, or threat scenario. It can define the hypothesis, required telemetry, query logic, validation methods, escalation criteria, and documentation requirements. Playbooks improve consistency and make successful investigations easier for other analysts to reproduce. They do not replace every security tool, increase endpoint storage, or modify hardware settings. A well-maintained playbook can also evolve as analysts discover new evidence sources, refine queries, and identify better methods for validating suspicious activity.

Question 172.

Which behavior can indicate possible network reconnaissance?

1. Repeated service discovery queries
2. Routine file synchronization
3. Normal system updates
4. Standard login activity

Correct Answer: 1

Explanation:

Repeated service discovery queries can indicate possible network reconnaissance because an attacker may attempt to identify available services, hosts, or network resources. Hunters can examine the source system, destination range, protocols, timing, and associated processes to determine whether the activity matches expected administrative behavior. File synchronization, system updates, and standard logins can be legitimate and do not inherently indicate reconnaissance. Network discovery should be interpreted within the environment because vulnerability scanners, management systems, and security tools may generate similar traffic. Correlation with user and process context can help distinguish legitimate scanning from suspicious behavior.

Question 173.

Which factor can help prioritize an unusual endpoint finding?

1. Wallpaper style
2. Keyboard manufacturer
3. Asset sensitivity
4. Monitor size

Correct Answer: 3

Explanation:

Asset sensitivity can help determine how much attention an unusual endpoint finding deserves. A suspicious event involving a system that stores sensitive information or supports critical business functions may require different investigative priority than the same event on a low-impact test device. Wallpaper style, keyboard manufacturer, and monitor size do not provide meaningful security prioritization context. Asset sensitivity should be combined with behavioral evidence, user identity, exposure, and potential impact. Accurate asset classification therefore helps threat hunters focus investigative resources while maintaining appropriate attention to significant findings.

Question 174.

What can file metadata contribute to threat hunting?

1. Information about file characteristics
2. Monitor calibration data
3. Printer supply levels
4. Network cable specifications

Correct Answer: 4

Explanation:

File metadata can provide information about characteristics such as timestamps, size, ownership, paths, and other attributes depending on the operating system and collection method. Hunters can use this information to establish when a file appeared, identify unusual locations, compare artifacts, and support timeline reconstruction. Monitor calibration, printer supplies, and cable specifications do not provide file-specific context. Metadata should be interpreted carefully because timestamps can be modified and file attributes may vary across systems. Combining metadata with hashes, execution records, and process telemetry can produce stronger investigative evidence.

Question 175.

Which pattern may indicate possible password spraying?

1. One account repeatedly targeted
2. Many accounts receiving similar failures
3. A single successful login
4. Routine password expiration

Correct Answer: 3

Explanation:

Many accounts receiving similar authentication failures can indicate possible password spraying, particularly when the attempts originate from the same or related sources. Password spraying typically spreads a small number of password attempts across multiple accounts rather than repeatedly targeting only one account. Hunters should examine source addresses, timing, authentication protocols, account populations, and successful logins to determine whether the pattern is suspicious. A single successful login or routine password expiration does not establish spraying behavior. One account receiving repeated failures may instead suggest password guessing or another authentication issue.

Question 176.

Which telemetry can link a file download to its initiating process?

1. Process and network correlation
2. Screen activity logs
3. Printer queue history
4. Keyboard preference data

Correct Answer: 1

Explanation:

Process and network correlation can connect a downloaded file or network transfer with the process responsible for initiating the communication. This relationship can help hunters determine whether a browser, scripting interpreter, command shell, or another application retrieved the file. Analysts can then investigate the process lineage, user account, destination, downloaded artifact, and subsequent execution. Screen activity, printer queues, and keyboard preferences do not provide equivalent process-to-network visibility. Correlating these telemetry sources is especially useful when investigating suspicious payload delivery or unauthorized downloads.

Question 177.

What can an unusual scheduled task indicate?

1. Possible persistence
2. Improved screen resolution
3. Printer synchronization
4. Battery optimization

Correct Answer: 4

Explanation:

An unusual scheduled task can indicate possible persistence because scheduled execution mechanisms allow programs or commands to run automatically at defined times or system events. Hunters should examine the task name, command, executable path, account, creation time, and trigger configuration. Legitimate administrators and applications also create scheduled tasks, so unusual characteristics should be validated before drawing conclusions. Screen resolution, printer synchronization, and battery optimization do not explain scheduled-task behavior. Correlating task creation with process and file telemetry can help determine whether the task represents legitimate configuration or suspicious persistence.

Question 178.

Which approach helps distinguish malicious activity from normal administrative behavior?

1. Ignoring asset context
2. Using contextual correlation
3. Removing historical telemetry
4. Treating every anomaly as malicious

Correct Answer: 3

Explanation:

Contextual correlation helps distinguish potentially malicious activity from normal administrative behavior by combining multiple evidence sources. A suspicious process, login, or network connection may be legitimate when associated with an approved administrator, maintenance window, management server, or expected application. Hunters can correlate user identity, asset role, timing, process lineage, network relationships, and historical behavior to build that context. Ignoring context, removing historical telemetry, or treating every anomaly as malicious increases the likelihood of false positives. Effective hunting depends on evaluating observations within the environment where they occurred.

Question 179.

What can historical DNS data support during an investigation?

1. Tracking past domain-resolution activity
2. Measuring monitor performance
3. Identifying printer faults
4. Calculating processor temperature

Correct Answer: 2

Explanation:

Historical DNS data can show which domains systems previously attempted to resolve. This information can support retrospective hunting when a suspicious domain, threat indicator, or infrastructure pattern is identified after the original activity occurred. Hunters can search historical records for affected hosts, query times, frequency, and related destinations. Monitor performance, printer faults, and processor temperature are unrelated to DNS history. Retrospective DNS analysis is particularly useful because it allows analysts to investigate activity that may have occurred before an indicator was added to security monitoring or threat-intelligence systems.

Question 180.

Which result should trigger refinement of a noisy hunting query?

1. Excessive benign matches
2. No stored telemetry
3. Correct query syntax
4. Expected test result

Correct Answer: 1

Explanation:

Excessive benign matches indicate that a hunting query may be too broad or insufficiently contextualized. The hunter should review the query conditions, thresholds, exclusions, and available enrichment to determine how the noise can be reduced without losing meaningful detections. No stored telemetry may indicate a collection gap, while correct syntax and expected test results do not necessarily indicate a problem. Query refinement is an iterative process. Analysts should test revised logic against both known benign and relevant suspicious activity to ensure that improvements reduce noise while preserving useful investigative coverage.