View Full Cisco 300-220 Exam Dumps and Practice Test Dumps

 

Question 321.

Which telemetry can expose unexpected script interpreter usage?

1. Printer activity
2. Process command-line records
3. Monitor settings
4. DHCP scope names

Correct Answer: 2

Explanation:

Process command-line records can reveal which script interpreters were executed and what commands or parameters they received. This information is useful for identifying unexpected PowerShell, Python, shell, or other interpreter activity on endpoints. Hunters can compare interpreter usage against normal application behavior and investigate unusual parent processes, accounts, execution paths, or command content. Printer activity, monitor settings, and DHCP scope names do not directly expose script execution. Command-line telemetry becomes particularly valuable when combined with process ancestry and identity information, allowing investigators to determine whether interpreter activity was initiated by an authorized user, application, or potentially suspicious process.

Question 322.

What helps identify hosts communicating outside their normal role?

1. Peer communication baseline
2. Desktop personalization
3. Keyboard configuration
4. File extension count

Correct Answer: 1

Explanation:

A peer communication baseline establishes the network behavior normally expected from comparable systems. If one endpoint communicates with destinations or services that its peers do not normally access, the difference can provide a useful hunting lead. For example, a workstation communicating with administrative infrastructure or unusual external services may warrant further investigation depending on its role. Baselines should account for legitimate exceptions such as specialized applications or maintenance activities. Desktop personalization, keyboard configuration, and file-extension counts do not directly describe network behavior. Comparing communication patterns among similar hosts can therefore highlight role-inconsistent network activity.

Question 323.

Which artifact can identify changes to local user accounts?

1. DNS request history
2. Network packet size
3. Account-management events
4. Browser rendering data

Correct Answer: 3

Explanation:

Account-management events can reveal creation, deletion, modification, or other changes involving local user accounts. These records can provide information about the affected account, responsible actor, timestamp, and type of modification. Hunters can use them to investigate unexpected account creation, privilege changes, or modifications that occur outside approved administrative procedures. DNS history and packet size describe network behavior, while browser rendering data is unrelated to account administration. Account-management telemetry becomes more valuable when correlated with authentication events, group membership changes, and subsequent process activity to determine whether the account modification was legitimate or part of suspicious behavior.

Question 324.

Why compare an endpoint against its historical behavior?

1. To increase storage capacity
2. To detect behavioral deviation
3. To change network routing
4. To update screen drivers

Correct Answer: 2

Explanation:

Historical comparison helps identify behavior that deviates from an endpoint’s established pattern. A system may normally communicate with a predictable set of services, execute a consistent collection of applications, and authenticate from familiar sources. A sudden change can provide a valuable hunting lead even when the activity does not match a predefined indicator. Historical behavior should be interpreted carefully because legitimate software deployments, role changes, and maintenance can also alter activity. Storage capacity, routing changes, and screen-driver updates do not address behavioral analysis. Comparing current activity with historical patterns therefore helps identify meaningful deviations requiring additional investigation.

Question 325.

Which evidence can associate a network connection with an executable?

1. Process-to-network telemetry
2. Printer queue history
3. User wallpaper settings
4. File extension statistics

Correct Answer: 1

Explanation:

Process-to-network telemetry can associate a network connection with the process responsible for creating it. This relationship helps hunters determine which executable initiated a connection, under which account, and at what time. Such context is useful when investigating suspicious outbound traffic because multiple applications may operate simultaneously on the same endpoint. A connection to an unusual destination becomes more significant when it can be tied to an unfamiliar executable, unexpected command line, or suspicious parent process. Printer history, wallpaper settings, and file-extension statistics do not establish process-to-network relationships. Correlating endpoint and network telemetry therefore provides valuable investigative context.

Question 326.

What can repeated failed logins from one source suggest?

1. Normal software deployment
2. Possible credential attack
3. Routine file indexing
4. Standard backup activity

Correct Answer: 2

Explanation:

Repeated failed logins originating from one source can suggest a possible credential attack, particularly when many accounts are targeted or attempts occur at unusual rates. Hunters should examine authentication methods, targeted usernames, timing, source systems, and whether successful authentication follows the failures. Legitimate applications can also generate repeated failures because of expired credentials or configuration errors, so the pattern requires contextual validation. Software deployment, file indexing, and backup activity do not inherently explain broad authentication failures. Authentication telemetry combined with endpoint and network context can help distinguish operational errors from potentially malicious credential-testing behavior.

Question 327.

Which record helps identify changes to scheduled execution?

1. Scheduled-task configuration
2. DNS response cache
3. Network interface status
4. Browser history

Correct Answer: 1

Explanation:

Scheduled-task configuration records can reveal additions, removals, and modifications to scheduled execution mechanisms. Hunters can inspect task names, triggers, executable paths, arguments, responsible accounts, and modification times. Unexpected changes may indicate persistence, unauthorized automation, or altered administrative workflows. However, legitimate software installations and maintenance processes can also create or modify scheduled tasks, so findings should be compared with approved baselines. DNS caches, interface status, and browser history do not directly document scheduled execution changes. Scheduled-task telemetry should also be correlated with process execution events to determine whether the configured task actually ran.

Question 328.

Which pattern can indicate abnormal authentication timing?

1. Regular business-hour access
2. Approved maintenance login
3. Access during unusual periods
4. Standard service authentication

Correct Answer: 3

Explanation:

Access during unusual periods can indicate authentication behavior that differs from an account’s established pattern. For example, a user account that normally authenticates during working hours may generate activity during unexpected periods. Timing alone does not establish compromise because remote work, maintenance, automation, or operational requirements can legitimately produce unusual login times. Hunters should correlate the timing with source location, device information, authentication method, privilege level, and subsequent activity. Regular business-hour access and approved maintenance logins are generally consistent with expected operations, while standard service authentication may follow automated schedules. Temporal anomalies become more meaningful when combined with additional identity evidence.

Question 329.

What should be examined when a new executable appears on a server?

1. File provenance and signer
2. Desktop background
3. Keyboard shortcuts
4. Screen timeout

Correct Answer: 1

Explanation:

File provenance and signer information can help determine whether a newly observed executable is legitimate. Provenance may provide clues about where the file originated, while digital-signature information can help identify its publisher and whether the binary has been altered. Hunters can also correlate these details with installation records, software inventories, execution events, and change-management documentation. Desktop backgrounds, keyboard shortcuts, and screen timeouts do not provide meaningful executable-validation context. A new executable should not automatically be treated as malicious because approved deployments and software updates can introduce new files. Multiple evidence sources should therefore be evaluated together.

Question 330.

Which network evidence can reveal unexpected protocol usage?

1. File ownership records
2. Flow metadata
3. User profile settings
4. Process memory size

Correct Answer: 2

Explanation:

Flow metadata can reveal communication characteristics such as source and destination addresses, ports, protocols, direction, timing, and volume. These details can help identify protocol usage that differs from the expected behavior of a host or service. For example, an endpoint communicating through an unusual protocol may warrant investigation when that protocol is inconsistent with its role or baseline. File ownership, profile settings, and process memory size do not directly characterize network protocols. Flow data should be correlated with process and asset information to identify which application generated the communication and determine whether the activity is legitimate.

Question 331.

Which observation may indicate suspicious archive creation?

1. Unexpected archive utility execution
2. Normal password expiration
3. Routine DNS lookup
4. Standard screen lock

Correct Answer: 1

Explanation:

Unexpected archive utility execution can provide a useful lead when investigating possible data staging. Attackers may use compression tools to combine multiple files before transferring them, although legitimate users and applications also create archives regularly. Hunters should examine the executing account, archive location, command-line arguments, source files, timing, and subsequent network activity. Password expiration, ordinary DNS lookups, and screen-lock events do not directly indicate archive creation. Archive-related activity becomes more significant when it occurs on sensitive hosts, involves unusual directories, or is followed by suspicious outbound communication. Multiple telemetry sources should be correlated before reaching an investigative conclusion.

Question 332.

What helps determine whether an administrative tool is expected?

1. Approved software baseline
2. Monitor model
3. Browser language
4. Desktop icon count

Correct Answer: 1

Explanation:

An approved software baseline helps determine whether an administrative tool is expected within the environment. Hunters can compare the tool’s presence, version, installation path, publisher, and associated endpoints against documented organizational standards. Administrative utilities can be legitimate and widely used by IT personnel, so simply discovering one should not be considered suspicious. An unexpected tool becomes more significant when it appears outside approved systems or is executed by an account that normally does not use it. Monitor models, browser language, and desktop icon counts provide no meaningful software-authorization context. Baseline comparison therefore supports more accurate assessment of administrative tooling.

Question 333.

Which evidence can identify suspicious changes to executable permissions?

1. File permission telemetry
2. DNS query volume
3. Network latency
4. Authentication geography

Correct Answer: 1

Explanation:

File permission telemetry can reveal changes affecting who may execute, modify, or access an executable. Unexpected permission changes may enable unauthorized execution or alter the security boundaries surrounding sensitive files. Hunters should examine the affected file, previous and new permissions, responsible account, timestamp, and associated process activity. Permission changes may also be legitimate during software installation or system administration, so the event should be compared against approved changes. DNS volume, network latency, and authentication geography provide different types of security context but do not directly document executable permission modifications. File-access telemetry can provide additional evidence about subsequent use.

Question 334.

Why correlate an authentication event with process execution?

1. To measure disk capacity
2. To identify related user activity
3. To adjust firewall speed
4. To calculate monitor size

Correct Answer: 2

Explanation:

Correlating authentication events with process execution can help determine what activity followed a particular login. Hunters can identify the authenticated account, originating system, session timing, and processes subsequently launched under that context. This relationship can be especially useful when investigating suspicious remote access or potentially compromised credentials. A login followed by unusual administrative commands, scripting activity, or network connections may provide a stronger investigative lead than either event viewed independently. Disk capacity, firewall speed, and monitor size are unrelated. Identity and process correlation therefore helps connect access events with the actions performed during the resulting session.

Question 335.

Which indicator can help identify unauthorized remote administration?

1. Unexpected remote session
2. Normal local logoff
3. Routine software update
4. Standard document access

Correct Answer: 1

Explanation:

An unexpected remote session can provide an important indicator of unauthorized remote administration. Hunters can examine the account used, source endpoint, destination system, session type, authentication method, and commands or processes launched during the session. Remote administration can be legitimate, so the activity should be compared against approved administrative workflows and expected account behavior. A normal local logoff, software update, or document access does not directly indicate remote administration. Correlating remote-session records with identity and process telemetry can help determine whether the session represents authorized maintenance, normal operational activity, or potentially suspicious access.

Question 336.

What can endpoint prevalence reveal about an unusual executable?

1. How widely it is observed
2. Its screen resolution
3. Its keyboard layout
4. Its printer destination

Correct Answer: 1

Explanation:

Endpoint prevalence shows how widely an executable is observed across the environment. A file present on thousands of comparable systems may fit an established software baseline, while an executable appearing on only one or a few systems may deserve closer examination. Low prevalence does not prove maliciousness because specialized applications and role-specific tools can legitimately have limited distribution. Hunters should combine prevalence with signer information, file hash, installation records, execution behavior, and endpoint role. Screen resolution, keyboard layout, and printer destination do not provide meaningful information about executable prevalence. Prevalence is therefore useful as contextual evidence during file investigations.

Question 337.

Which behavior can support a hypothesis of lateral movement?

1. Accessing several internal hosts
2. Reading one local document
3. Changing a browser theme
4. Updating a calendar

Correct Answer: 1

Explanation:

Accessing several internal hosts can support a hypothesis of lateral movement, particularly when the same account or endpoint establishes remote sessions across systems that are not normally accessed together. Hunters should examine destination hosts, authentication methods, timing, account privileges, and processes launched after each connection. Legitimate administrative activity can produce similar patterns, so the behavior must be compared with known operational workflows. Reading a local document, changing a browser theme, and updating a calendar do not directly demonstrate movement between systems. Multiple-host access becomes more informative when correlated with remote authentication and process execution telemetry.

Question 338.

What helps distinguish legitimate scheduled activity from suspicious automation?

1. Approved scheduling records
2. Monitor power history
3. Browser cache size
4. Keyboard language

Correct Answer: 1

Explanation:

Approved scheduling records provide context for determining whether recurring automated activity is expected. Hunters can compare the observed task, service, script, execution time, account, and target system with documented maintenance schedules or approved automation. A recurring process that lacks a corresponding approved record may warrant additional investigation, particularly when its executable path or command line is unusual. Monitor power history, browser cache size, and keyboard language do not explain why a task executes on a schedule. Scheduling records should be correlated with process execution and configuration telemetry to establish whether the automation is legitimate or potentially unauthorized.

Question 339.

Which evidence can show whether a suspicious process contacted an external host?

1. Process-network correlation
2. File naming conventions
3. Desktop theme history
4. User profile color

Correct Answer: 1

Explanation:

Process-network correlation can show whether a specific process established communication with an external host. This relationship allows hunters to connect endpoint execution with network activity and examine the destination, port, timing, volume, and account context. Such evidence is valuable when investigating suspicious executables because network telemetry alone may not reveal which application initiated a connection. File naming conventions, desktop themes, and profile colors do not establish network communication. Process-network correlation should be combined with destination reputation, process lineage, and command-line information to determine whether the observed external communication is expected or requires deeper investigation.

Question 340.

What should be reviewed when a hunting hypothesis remains unproven?

1. Supporting and contradictory evidence
2. Desktop personalization
3. Printer preferences
4. Monitor brightness

Correct Answer: 1

Explanation:

When a hunting hypothesis remains unproven, both supporting and contradictory evidence should be reviewed. A balanced assessment helps determine whether the hypothesis needs refinement, additional telemetry, a narrower scope, or complete abandonment. Hunters should document what evidence was observed, what expected evidence was missing, and which assumptions were not supported. This prevents premature conclusions based on a single suspicious event. Desktop personalization, printer preferences, and monitor brightness generally provide no meaningful evidence for evaluating a security hypothesis. Reviewing both confirming and disproving observations creates a stronger analytical foundation for deciding how the investigation should proceed.