View Full Cisco 300-220 Exam Dumps and Practice Test Dumps

 

Question 381.

Which evidence can reveal suspicious modifications to endpoint logging?

1. Browser history
2. File ownership
3. Network latency
4. Logging configuration events

Correct Answer: 4

Explanation:

Logging configuration events can reveal changes that reduce or alter endpoint visibility. Hunters can examine whether audit settings, logging levels, event categories, or collection destinations were modified. Unexpected reductions in logging may indicate attempts to conceal activity, although legitimate troubleshooting or performance adjustments can also produce similar changes. The responsible account, process, timestamp, and change-management records should therefore be reviewed. Browser history, file ownership, and network latency do not directly describe logging configuration. Correlating configuration changes with other suspicious events can help determine whether the modification was operationally expected or potentially intended to impair security monitoring.

Question 382.

What helps identify unusual connections from a server?

1. Keyboard layout
2. Server communication baseline
3. Browser bookmarks
4. Printer settings

Correct Answer: 2

Explanation:

A server communication baseline helps identify network connections that differ from the server’s expected behavior. Servers usually have predictable communication patterns based on their applications and roles. A connection to an unfamiliar destination, unexpected protocol, or unusual port can become a useful investigative lead when it falls outside that baseline. Legitimate maintenance, monitoring, and application changes can also create exceptions, so the finding should be correlated with change records and process telemetry. Keyboard layouts, bookmarks, and printer settings do not describe server communication. Baseline comparison therefore provides valuable context for identifying unusual server network activity.

Question 383.

Which artifact can show an application created a new process?

1. Process creation telemetry
2. DNS resolver data
3. Firewall policy history
4. Account expiration records

Correct Answer: 1

Explanation:

Process creation telemetry records the launch of a new process and can often provide the executable path, parent process, user context, timestamp, and command-line information. This makes it valuable for determining whether an application created an unexpected child process. Hunters can use process relationships to identify unusual execution chains, scripting activity, or potentially abused applications. DNS resolver data describes name resolution, firewall history describes network-control configuration, and account expiration records concern identity management. None directly establishes process creation. Combining process creation data with parent-child relationships and command-line information can provide stronger evidence during endpoint investigations.

Question 384.

Why compare network behavior before and after a software installation?

1. To measure display performance
2. To identify keyboard changes
3. To detect communication changes
4. To count printer pages

Correct Answer: 3

Explanation:

Comparing network behavior before and after software installation can reveal communication changes introduced by the new application. Hunters may identify newly contacted domains, external destinations, service ports, connection frequencies, or unusual traffic volumes. This comparison does not automatically indicate malicious behavior because legitimate software may require new network services. However, unexpected communication that was absent before installation can provide a useful lead for additional investigation. Display performance, keyboard changes, and printer-page counts are unrelated to network behavior. Combining installation records with process-to-network telemetry can help determine which newly installed component generated the observed communication.

Question 385.

Which indicator can suggest unauthorized modification of a protected file?

1. Normal application launch
2. Unexpected file hash change
3. Routine DNS lookup
4. Standard user logout

Correct Answer: 2

Explanation:

An unexpected file hash change can indicate that the contents of a protected file were modified. Hunters can compare the current hash against a known-good value and examine when the change occurred, which account performed the modification, and which process accessed the file. Legitimate updates can also change file hashes, so the modification should be compared against approved software versions and maintenance records. A normal application launch, routine DNS lookup, or standard logout does not directly indicate file alteration. Hash comparison becomes more useful when combined with file timestamps, process activity, and software deployment information.

Question 386.

Which source can reveal unusual privilege use across accounts?

1. Identity privilege events
2. Browser cache records
3. Printer queue data
4. Screen resolution logs

Correct Answer: 1

Explanation:

Identity privilege events can reveal when accounts receive, use, or change elevated permissions. Hunters can investigate which account performed a privileged action, when it occurred, from which system, and whether the activity matches expected administrative responsibilities. Unusual privilege use may indicate misuse of legitimate credentials or unauthorized escalation, but legitimate maintenance can generate similar events. Browser caches, printer queues, and screen resolution logs do not provide meaningful privilege context. Identity telemetry should be correlated with process execution and session information to determine what actions were performed using the elevated privileges and whether the behavior was consistent with organizational expectations.

Question 387.

What can reveal whether a destination is uncommon for a user group?

1. File compression ratio
2. Desktop configuration
3. Group communication baseline
4. Monitor refresh rate

Correct Answer: 3

Explanation:

A group communication baseline can reveal whether a destination is unusual for users performing similar roles. Comparing network behavior across a peer group can identify destinations that are routinely accessed by comparable users versus destinations contacted by only one account or a small subset. Unusual destinations can become investigation leads, especially when combined with unexpected processes, abnormal timing, or sensitive data access. File compression ratios, desktop configuration, and monitor refresh rates do not provide useful network comparison data. Group-based analysis should account for legitimate role-specific applications and remote-access requirements before treating a rare destination as suspicious.

Question 388.

Which evidence can identify suspicious modifications to service startup mode?

1. Browser download records
2. DNS request history
3. Service configuration telemetry
4. Printer connection events

Correct Answer: 3

Explanation:

Service configuration telemetry can reveal changes to how a service starts, including transitions between automatic, manual, or disabled states. Unexpected startup-mode changes may affect persistence or system availability and can be important during threat hunting. Hunters should examine the service name, executable path, responsible account, modification time, and related process activity. Legitimate software installation and administrative maintenance can also change service startup behavior, so approved change records should be checked. Browser downloads, DNS requests, and printer events do not directly document service configuration. Service telemetry therefore provides the most relevant evidence for investigating startup-mode changes.

Question 389.

Which pattern can suggest abnormal use of a privileged account?

1. Access matching its normal role
2. Routine scheduled maintenance
3. Unexpected access to unrelated systems
4. Approved administrative deployment

Correct Answer: 3

Explanation:

Unexpected access to unrelated systems can suggest abnormal use of a privileged account when the activity falls outside the account’s established responsibilities. Hunters should examine the destination systems, access timing, source endpoint, authentication method, commands executed, and whether the account normally administers those resources. Privileged accounts often have broad permissions, so unusual access should be investigated rather than automatically treated as malicious. Normal role-based access, scheduled maintenance, and approved deployments can explain many privileged events. Identity baselines combined with remote-session and process telemetry can help determine whether the observed access was consistent with legitimate administrative activity.

Question 390.

What helps identify a suspicious process that repeatedly contacts one destination?

1. Printer status
2. Process-network timing
3. Keyboard configuration
4. File extension count

Correct Answer: 2

Explanation:

Process-network timing can reveal repeated communication between a specific process and destination. Hunters can examine connection intervals, destination address, port, traffic volume, process identity, and command-line parameters. Regular repeated communication may indicate automated application behavior or potentially command-and-control activity. Timing alone does not establish maliciousness because legitimate services often communicate periodically. Printer status, keyboard configuration, and file-extension counts do not connect process execution with network activity. Correlating process and network timestamps allows investigators to identify which executable is responsible for recurring connections and determine whether its behavior matches the expected endpoint baseline.

Question 391.

Which artifact can expose newly created local administrative accounts?

1. Account-creation audit events
2. DNS cache records
3. Network packet sizes
4. Browser session history

Correct Answer: 1

Explanation:

Account-creation audit events can identify when new local accounts are created and provide useful information about the responsible actor and timestamp. Hunters can examine the account name, privileges, group memberships, creation source, and subsequent authentication activity. Unexpected administrative accounts may warrant investigation, particularly when they appear outside normal provisioning workflows. However, legitimate system management or software installation can also create accounts. DNS cache records, packet sizes, and browser session history do not directly document account creation. Combining account-audit telemetry with privilege and authentication events can help determine whether the newly created account was expected or potentially unauthorized.

Question 392.

Which behavior may indicate suspicious use of a trusted application?

1. Normal application startup
2. Standard document viewing
3. Expected software update
4. Unexpected child-process execution

Correct Answer: 4

Explanation:

Unexpected child-process execution from a trusted application can provide a useful hunting signal. Applications that normally perform document viewing or routine business functions may occasionally be abused to launch scripts, shells, or other executables. Hunters should examine the parent application, child process, command-line arguments, user identity, file path, and timing. Legitimate plugins, updates, and application features can also create child processes, so the relationship must be evaluated against the application’s normal behavior. Standard startup or document viewing alone does not indicate misuse. Process lineage provides important evidence when determining whether a trusted application behaved unexpectedly.

Question 393.

What can reveal an endpoint’s normal destination set?

1. Historical network relationships
2. Screen-lock events
3. Printer driver versions
4. Keyboard language settings

Correct Answer: 1

Explanation:

Historical network relationships can establish which destinations an endpoint normally communicates with. Hunters can examine recurring domains, addresses, ports, protocols, and communication frequency over time to create a behavioral baseline. A newly observed destination can then be identified as an anomaly when it falls outside that established set. Historical communication should not be treated as proof of legitimacy because compromised systems may have communicated with malicious infrastructure for an extended period. Screen locks, printer drivers, and keyboard settings do not establish destination relationships. Historical network analysis therefore provides useful context for identifying communication anomalies.

Question 394.

Which evidence can help determine whether an executable is newly installed?

1. Network packet direction
2. Installation timestamp
3. Printer queue status
4. Screen resolution

Correct Answer: 2

Explanation:

An installation timestamp can help establish when an executable or software package was introduced to a system. Hunters can correlate that timestamp with deployment records, file creation events, configuration changes, and subsequent process execution. A newly installed executable should be evaluated within the context of approved software-management procedures because legitimate updates can create new files. Network packet direction, printer queue status, and screen resolution do not directly establish installation timing. Installation timestamps become especially valuable when investigating artifacts that appeared shortly before suspicious behavior, allowing analysts to build a more accurate sequence of events.

Question 395.

Which activity can indicate unauthorized modification of security settings?

1. Reading a local document
2. Normal application launch
3. Disabling a protection feature
4. Routine system shutdown

Correct Answer: 3

Explanation:

Disabling a protection feature can indicate unauthorized modification of security settings, particularly when the change occurs without an approved administrative reason. Hunters should examine which account performed the change, which process initiated it, when it happened, and whether a documented maintenance activity explains the modification. Legitimate troubleshooting and software deployment can sometimes alter security settings, so the event should be evaluated against organizational baselines. Reading documents, normal application launches, and system shutdowns do not directly indicate security-control modification. Configuration telemetry combined with identity and process information can help establish whether the change was expected or potentially suspicious.

Question 396.

What should be correlated with an unusual outbound connection?

1. Process and identity context
2. Monitor manufacturer
3. Printer paper size
4. Desktop wallpaper

Correct Answer: 1

Explanation:

Process and identity context can help explain who initiated an unusual outbound connection and which application generated it. Hunters can correlate the destination with the initiating process, account, command line, parent process, endpoint role, and connection timestamp. This context can distinguish legitimate application traffic from communication generated by an unfamiliar or unauthorized process. Monitor manufacturers, printer paper size, and desktop wallpaper do not provide useful connection context. Network destination information should also be reviewed alongside historical communication patterns and threat-intelligence data to determine whether the connection represents an expected service or a potentially suspicious event.

Question 397.

Which evidence can identify unusual access to sensitive databases?

1. Browser bookmarks
2. Database audit records
3. Screen brightness
4. Printer preferences

Correct Answer: 2

Explanation:

Database audit records can reveal who accessed a database, which objects were queried, when access occurred, and sometimes the type of operation performed. This telemetry is valuable when investigating unusual access to sensitive information because it provides direct visibility into database activity. Hunters can compare the observed account, query patterns, timing, and accessed objects against established baselines. Browser bookmarks, screen brightness, and printer preferences do not provide database-access evidence. Database audit information should be correlated with identity and endpoint telemetry to determine whether the access was performed by an authorized application or account and whether the activity matched expected business behavior.

Question 398.

Which pattern may indicate automated persistence execution?

1. One-time manual launch
2. Normal application closure
3. Repeated execution after logon
4. Routine file browsing

Correct Answer: 3

Explanation:

Repeated execution after logon can indicate an automated persistence mechanism when an application or script launches consistently without an expected manual action. Hunters can examine startup entries, scheduled tasks, services, login scripts, executable paths, and process lineage to determine how the repeated execution is triggered. Legitimate applications also commonly start after logon, so recurrence alone does not prove malicious persistence. One-time manual execution, application closure, and routine file browsing do not provide the same persistence signal. Correlating repeated execution with configuration changes and software inventories can help distinguish authorized startup behavior from suspicious persistence.

Question 399.

What helps validate that suspicious activity affected multiple hosts?

1. Cross-host telemetry correlation
2. Browser cache comparison
3. Printer configuration review
4. Monitor setting analysis

Correct Answer: 1

Explanation:

Cross-host telemetry correlation helps determine whether similar suspicious activity occurred across multiple systems. Hunters can compare process execution, authentication events, file hashes, network destinations, timestamps, and configuration changes between affected endpoints. Identifying common characteristics can reveal whether an incident is isolated or part of a broader activity pattern. Browser cache, printer configuration, and monitor settings generally provide little value for cross-host security correlation. Cross-host analysis should consider endpoint roles and expected software differences so that legitimate environmental variation is not mistaken for malicious activity. Correlated evidence can also help identify additional systems requiring investigation.

Question 400.

Which outcome best supports converting a completed hunt into ongoing monitoring?

1. Unrelated system changes
2. Random endpoint differences
3. Documented behavioral indicators
4. Temporary desktop settings

Correct Answer: 3

Explanation:

Documented behavioral indicators provide a strong foundation for converting a completed hunt into ongoing monitoring. Once a hunting investigation identifies reliable observable characteristics, those behaviors can be translated into detection rules, analytics, or monitoring logic. Documentation should include the relevant telemetry, conditions, expected false positives, environmental context, and evidence supporting the behavior. This allows detection engineers to create monitoring that is reproducible and maintainable. Random endpoint differences, temporary desktop settings, and unrelated system changes do not provide reliable detection foundations. Turning validated hunting knowledge into continuous monitoring helps identify similar activity without requiring the same manual investigation to be repeated.