View Full Cisco 300-220 Exam Dumps and Practice Test Dumps

 

Question 141.

Which telemetry can reveal unusual registry modifications?

1. DNS response data
2. Registry change events
3. Network route tables
4. Printer queue records

Correct Answer: 2

Explanation:

Registry change events can help hunters identify modifications to operating-system configuration and application settings. Attackers may alter registry locations to establish persistence, modify security settings, or influence application behavior. Hunters can examine which key changed, what value was modified, when the change occurred, and which process or account was responsible. DNS responses and route tables provide network information, while printer queues concern printing operations. Registry telemetry becomes more useful when correlated with process execution, user identity, and other endpoint evidence to determine whether a modification was expected or potentially suspicious.

Question 142.

What can unusual DNS record types help a hunter identify?

1. Hardware inventory
2. Potential tunneling behavior
3. Display configuration
4. Local printer usage

Correct Answer: 4

Explanation:

Unusual DNS record types or patterns can sometimes provide clues about DNS tunneling or other uncommon communication techniques. Hunters may examine query types, frequency, domain structure, response sizes, and requesting hosts to determine whether the activity differs from normal DNS usage. However, unusual DNS behavior does not automatically indicate malicious activity because legitimate applications may use uncommon records. Hardware inventory, display configuration, and printer usage are unrelated to DNS analysis. DNS telemetry becomes more informative when correlated with endpoint processes and network connections associated with the requesting system.

Question 143.

Which approach can identify changes from an established endpoint baseline?

1. Configuration comparison
2. Cable testing
3. Printer monitoring
4. Battery analysis

Correct Answer: 1

Explanation:

Configuration comparison evaluates an endpoint against a known baseline to identify changes. Hunters can compare installed services, startup entries, security settings, applications, scheduled tasks, or other configuration elements with previously established expectations. Unexpected modifications may warrant investigation, particularly when they occur near other suspicious activity. Cable testing, printer monitoring, and battery analysis do not provide comparable endpoint-configuration visibility. Baseline comparison is most effective when the reference configuration is accurate and current. Legitimate software updates and administrative changes should also be considered before treating a difference as malicious.

Question 144.

What can process integrity information help determine?

1. Screen quality
2. Network bandwidth
3. Whether execution context is unusual
4. Printer availability

Correct Answer: 3

Explanation:

Process integrity information can help determine whether a process is running under an expected security context or privilege level. Unexpected elevated execution can be an important hunting signal, particularly when associated with unusual applications or user accounts. Analysts can compare process integrity with the executable, parent process, account, command line, and host role. Screen quality, network bandwidth, and printer availability address unrelated operational concerns. Integrity information should not be considered independently; legitimate administrative software can also operate with elevated privileges, so surrounding context is necessary for accurate interpretation.

Question 145.

Which activity may indicate remote service execution?

1. Routine screen locking
2. Standard file indexing
3. Unexpected service-based process launch
4. Normal time synchronization

Correct Answer: 4

Explanation:

An unexpected service-based process launch may indicate remote service execution and can warrant investigation. Attackers can abuse legitimate service mechanisms to execute commands on another host after obtaining appropriate access. Hunters can examine the service name, executable path, account context, creation time, source system, and related network activity. Screen locking, file indexing, and time synchronization are generally normal system activities. Service execution should be evaluated against administrative baselines because legitimate management platforms may also create or start services remotely.

Question 146.

What does lateral movement analysis primarily examine?

1. Host-to-host access patterns
2. Monitor specifications
3. Software license counts
4. Battery discharge rates

Correct Answer: 2

Explanation:

Lateral movement analysis examines how activity moves between systems within an environment. Hunters may analyze remote logins, administrative protocols, service execution, authentication relationships, and host-to-host network connections. The goal is to identify access patterns that could indicate an attacker moving from an initially compromised system toward additional resources. Monitor specifications, software license counts, and battery discharge rates are unrelated to lateral movement. Internal network visibility combined with identity and endpoint telemetry can provide stronger evidence about whether observed host-to-host activity is expected administrative behavior or potentially suspicious movement.

Question 147.

Which indicator can help identify a suspicious executable across systems?

1. File hash
2. Monitor model
3. Keyboard layout
4. Screen resolution

Correct Answer: 1

Explanation:

A file hash can provide a consistent identifier for a particular file’s content. Hunters can search endpoint telemetry for the same hash to determine whether an executable appears on multiple systems. Hashes are useful for identifying known files, comparing collected samples, and finding recurring artifacts. They are not sufficient by themselves to explain whether a file is malicious because legitimate software can share known hashes and attackers can modify files. Monitor models, keyboard layouts, and screen resolutions do not provide comparable executable identification capabilities.

Question 148.

Why can parent-process analysis be valuable?

1. It measures disk capacity
2. It reveals execution origin
3. It changes network routes
4. It validates printer drivers

Correct Answer: 2

Explanation:

Parent-process analysis helps determine what process initiated another process. This execution origin can reveal suspicious relationships that may not be obvious from the child process alone. For example, a scripting interpreter launched by an unexpected application can provide an important hunting signal. Hunters can combine parent-child relationships with command-line parameters, user identity, timestamps, and network activity. Disk capacity, network routes, and printer drivers do not explain process origin. Understanding execution lineage is therefore an important part of endpoint investigations involving potentially malicious process activity.

Question 149.

Which observation can strengthen a suspected command-and-control finding?

1. Matching screen settings
2. Normal keyboard activity
3. Correlated beacon-like network timing
4. Standard printer configuration

Correct Answer: 3

Explanation:

Correlated beacon-like network timing can strengthen a suspected command-and-control finding when repeated connections occur at unusual intervals and are associated with suspicious endpoint activity. Hunters can examine connection periodicity, destination infrastructure, process ownership, and related DNS requests. Timing alone does not establish malicious command-and-control because legitimate applications can also communicate periodically. Screen settings, keyboard activity, and printer configuration generally provide little evidence about network command channels. Combining network timing with endpoint and intelligence data creates stronger investigative context and helps distinguish suspicious automation from normal application behavior.

Question 150.

What can endpoint process trees help investigators reconstruct?

1. Network cable paths
2. Execution sequences
3. Printer maintenance history
4. Display calibration events

Correct Answer: 4

Explanation:

Endpoint process trees help investigators reconstruct execution sequences by showing relationships between parent and child processes. This can reveal how an application started another program, whether a scripting engine was launched unexpectedly, or whether multiple processes formed a suspicious chain. Network cable paths, printer maintenance, and display calibration do not involve process lineage. Process trees are particularly valuable during malware investigations because they provide temporal and structural context around execution. Analysts can combine process-tree evidence with command lines, user accounts, file paths, and network connections to build a more complete picture.

Question 151.

Which log source is most relevant to investigating failed privilege escalation?

1. Authentication and authorization logs
2. Display configuration logs
3. Printer status records
4. Audio device events

Correct Answer: 1

Explanation:

Authentication and authorization logs are highly relevant when investigating failed privilege escalation because they can record access attempts, account identities, privilege-related events, and authorization outcomes. Hunters can correlate these records with process execution and endpoint activity to determine whether a user or process attempted to obtain higher privileges. Display, printer, and audio logs generally provide unrelated information. Privilege escalation investigations benefit from combining identity telemetry with endpoint evidence because the sequence of authentication, process execution, and authorization events can reveal how an attempted escalation occurred.

Question 152.

What does infrastructure pivoting allow a hunter to do?

1. Change firewall hardware
2. Replace endpoint software
3. Expand investigation through related indicators
4. Reconfigure display settings

Correct Answer: 3

Explanation:

Infrastructure pivoting allows a hunter to expand an investigation from one known indicator to related infrastructure or artifacts. For example, an identified domain may lead investigators to examine associated addresses, certificates, hosting relationships, or other infrastructure characteristics. This approach can uncover additional indicators that were not initially known. Firewall hardware, endpoint software, and display settings are unrelated to investigative pivoting. Infrastructure relationships should be validated carefully because shared hosting and common services can create legitimate associations that do not necessarily indicate malicious coordination.

Question 153.

Which artifact can reveal recent changes to Windows services?

1. Service configuration records
2. DNS cache entries
3. Screen saver settings
4. Browser bookmarks

Correct Answer: 4

Explanation:

Service configuration records can reveal changes involving Windows services, including newly created services, modified executable paths, startup behavior, and associated accounts. Attackers may abuse services for persistence or execution, making unexpected service changes useful hunting signals. DNS cache entries provide name-resolution information, while screen saver settings and browser bookmarks address unrelated endpoint functions. Service evidence should be correlated with timestamps, process activity, account context, and file paths to determine whether the modification was part of legitimate administration or potentially unauthorized activity.

Question 154.

What can unusual parent-child relationships indicate?

1. Unexpected execution behavior
2. Increased monitor brightness
3. Printer paper shortages
4. Lower battery capacity

Correct Answer: 1

Explanation:

Unusual parent-child process relationships can indicate unexpected execution behavior. For instance, an office application launching a command interpreter or a system utility spawning an unfamiliar executable may deserve closer examination. Such relationships do not automatically prove malicious activity because legitimate software can create unusual process chains. Hunters should investigate the executable, command line, user, timing, file location, and related network connections. Monitor brightness, printer supplies, and battery capacity do not provide useful process-lineage information. Process relationships are particularly valuable because they expose how execution originated and progressed on an endpoint.

Question 155.

Which network attribute helps distinguish communication services?

1. Screen orientation
2. Destination port
3. Keyboard language
4. Disk manufacturer

Correct Answer: 2

Explanation:

Destination ports help identify the network service associated with a connection. Hunters can examine destination ports together with protocols, addresses, timestamps, and process information to determine whether communications match expected application behavior. A port number alone does not prove which application is responsible or whether the connection is malicious because services can use nonstandard ports. Screen orientation, keyboard language, and disk manufacturer do not provide equivalent network-service information. Port analysis becomes more useful when combined with flow records and endpoint telemetry to establish the context of suspicious communications.

Question 156.

Which practice helps reduce noise in a behavioral hunt?

1. Removing all contextual data
2. Ignoring historical activity
3. Applying environment-specific filters
4. Disabling telemetry collection

Correct Answer: 3

Explanation:

Environment-specific filters can reduce noise by excluding activity that is known to be legitimate within a particular organization. For example, approved administrative tools, trusted management servers, or expected automated processes may be excluded when appropriate. Removing contextual data, ignoring historical behavior, or disabling telemetry would generally make investigations less accurate. Filters should be carefully documented and periodically reviewed because legitimate infrastructure changes can make previously safe exclusions inappropriate. Proper tuning helps hunters focus on meaningful deviations while maintaining sufficient visibility for discovering genuinely suspicious behavior.

Question 157.

What can endpoint isolation help accomplish during an active investigation?

1. Limit potential host communication
2. Increase monitor resolution
3. Repair printer hardware
4. Expand disk capacity

Correct Answer: 4

Explanation:

Endpoint isolation can limit a potentially compromised host’s network communication while allowing investigators to continue examining the system. This can help reduce the opportunity for an attacker or malicious process to communicate with external infrastructure or other internal systems. Isolation should follow established incident-response procedures because completely disconnecting a system may affect evidence collection or business operations. Monitor resolution, printer hardware, and disk capacity are unrelated objectives. Endpoint isolation is a containment measure rather than a hunting technique itself, but hunting findings may provide evidence supporting its use during incident response.

Question 158.

Which source can reveal commands executed by an authenticated user?

1. Process command-line telemetry
2. Display event logs
3. Printer usage records
4. Power-management events

Correct Answer: 1

Explanation:

Process command-line telemetry can reveal commands executed by processes associated with an authenticated user. This evidence can help investigators understand administrative actions, scripting activity, discovery commands, or potentially malicious execution. Hunters should examine command-line information alongside the user identity, parent process, executable path, timestamps, and related network activity. Display events, printer usage, and power-management records do not normally expose command execution. Command-line telemetry can be especially valuable when investigating activity performed through legitimate interpreters or administrative utilities that attackers may also abuse.

Question 159.

What does threat-intelligence confidence help an analyst assess?

1. Monitor compatibility
2. Printer reliability
3. Indicator reliability
4. Disk performance

Correct Answer: 3

Explanation:

Threat-intelligence confidence helps analysts assess how reliable an intelligence item or indicator is based on its source, supporting evidence, validation, and historical accuracy. Confidence can help hunters decide how much investigative weight to assign to an indicator. A high-confidence indicator may justify more immediate investigation, while lower-confidence information may require additional validation. Monitor compatibility, printer reliability, and disk performance are unrelated concepts. Intelligence confidence should still be considered alongside internal telemetry because an externally reported indicator may have different relevance within a specific environment.

Question 160.

Which outcome shows that a hunting hypothesis was successfully validated?

1. The query returned no data
2. Evidence matched the expected behavior
3. All logs were deleted
4. Monitoring was disabled

Correct Answer: 2

Explanation:

A hunting hypothesis is successfully validated when collected evidence supports the expected behavior described by the hypothesis. The evidence should be sufficiently relevant and reliable to demonstrate that the investigated activity actually occurred. A query returning no data may disprove the hypothesis or indicate insufficient telemetry, while deleting logs or disabling monitoring removes useful evidence. Successful validation should also include appropriate documentation and, where applicable, additional corroborating evidence. Once validated, the finding can potentially support detection development, incident response, threat intelligence, or additional targeted hunting.