Cisco Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity 300-220 CBRTHD Exam Questions

Answer : B

The correct answer is mapping trust relationships between identity systems. Hybrid identity environments introduce complex trust boundaries that attackers routinely exploit.

Modern breaches increasingly involve identity pivoting, where attackers compromise a cloud identity and abuse synchronization, federation, or conditional access misconfigurations to escalate into on-prem Active Directory. These attack paths often do not rely on software vulnerabilities at all.

Option A is too narrow and focuses only on technical exploits. Option C measures severity but does not model movement. Option D analyzes traffic but does not explain privilege escalation pathways.

By mapping trust relationships---such as Azure AD Connect synchronization, service principals, hybrid admin roles, and conditional access exclusions---defenders can identify chained attack paths that enable privilege escalation without exploiting code.

From a threat hunting standpoint, this modeling enables:

Hypothesis-driven hunts

Detection of abnormal role assumptions

Visibility into identity abuse

This approach aligns with attack path modeling, a critical evolution of traditional threat modeling for identity-centric environments. Therefore, option B is correct.

Answer : C

The correct answer is analyzing abnormal behavior patterns across identity, endpoint, and network telemetry. This approach represents the foundation of modern threat hunting and directly addresses adversaries who deliberately avoid traditional detections.

Advanced attackers increasingly rely on living-off-the-land techniques, stolen credentials, and legitimate administrative tools such as PowerShell, WMI, RDP, and cloud APIs. These activities rarely generate malware signatures or known IOCs, making alert-driven and signature-based defenses insufficient. As a result, mature threat hunting programs shift focus toward behavioral analysis and anomaly detection.

Option A and D rely on static indicators such as IPs, domains, and hashes. These sit at the lowest levels of the Pyramid of Pain and are trivial for attackers to change. Option B is purely reactive and limited to known malware, offering little value against stealthy intrusions.

By correlating identity logs (authentication patterns, geolocation anomalies), endpoint telemetry (process execution, parent-child relationships), and network activity (unusual connections, lateral movement patterns), hunters can detect Indicators of Attack (IOAs) rather than waiting for confirmed compromise. This enables identification of credential misuse, privilege abuse, and lateral movement even when no malware is present.

This methodology aligns with MITRE ATT&CK TTP-based hunting, which focuses on tactics and techniques instead of tools or infrastructure. It also reflects a higher tier in the Threat Hunting Maturity Model, where organizations proactively search for unknown threats rather than responding to alerts.

In professional SOC environments, this shift dramatically increases detection coverage against advanced adversaries and reduces dwell time. Therefore, option C is the most accurate and strategically sound answer.

Answer : C

The correct answer is converting hunt findings into permanent detections. Threat hunting is only effective when discoveries are operationalized.

Without converting findings into SIEM, EDR, or NDR detections, organizations repeatedly identify the same attacker behaviors, wasting time and resources. Options A, B, and D improve capacity but do not eliminate blind spots.

Mature threat hunting programs ensure that:

Hunts produce detection rules

Alerts are tuned and validated

Knowledge is institutionalized

This is a defining trait of high-maturity security organizations and directly improves resilience. Therefore, option C is correct.

Answer : A

The correct answer is Exploit public-facing application. The log excerpt in the exhibit clearly shows a malicious HTTP GET request targeting a WordPress plugin PHP file with a crafted SQL injection payload:

UNION ALL SELECT CONCAT(...)

This syntax is a classic indicator of SQL injection, a well-documented attack technique used to exploit insufficient input validation in web applications. According to the MITRE ATT&CK framework, this behavior maps to the Initial Access tactic (TA0001) and the technique Exploit Public-Facing Application (T1190). The attacker is directly interacting with a publicly accessible web service and abusing a vulnerability in the application code to gain unauthorized access.

From a threat hunting and forensic standpoint, this is a textbook example of how attackers commonly achieve initial access to web servers. The attacker did not authenticate via remote services (such as SSH or RDP), nor did they rely on user interaction (as in a drive-by compromise). Instead, they sent a specially crafted request to a vulnerable endpoint exposed to the internet. This makes option B incorrect because External Remote Services requires legitimate service access mechanisms. Option C is also incorrect because Command and Scripting Interpreter is typically used after initial access, once code execution is already achieved. Option D does not apply because there is no evidence of malicious content being delivered to end users.

The forensic team's actions---isolating the server, cloning the disk, and analyzing logs---are standard post-incident procedures to reconstruct the attack chain. Web server access logs are especially valuable in these cases, as they often reveal malicious payloads, attacker IP addresses, targeted endpoints, and timestamps.

For defenders and threat hunters, this scenario reinforces the importance of monitoring web logs for anomalous query strings, enforcing secure coding practices, conducting regular vulnerability scans, and promptly patching third-party plugins. Public-facing applications remain one of the most exploited initial access vectors, making this technique a critical focus area in modern threat hunting programs.

Answer : B

The correct answer is endpoint process ancestry tracking. Credential harvesting attacks frequently rely on fileless execution and living-off-the-land techniques.

When no files are written to disk, hash-based detection (Option A) is ineffective. Email sandboxing (Option C) and URL filtering (Option D) may detect initial delivery but provide little visibility into post-execution behavior.

Cisco Secure Endpoint provides detailed telemetry on:

Parent-child process relationships

Unexpected process spawning

Abnormal command-line arguments

Memory-resident execution

By analyzing process ancestry, hunters can identify suspicious chains such as:

Office applications spawning scripting engines

Browsers spawning credential-harvesting processes

Legitimate binaries launching unexpected child processes

This capability directly supports MITRE ATT&CK Credential Access and Defense Evasion techniques and is explicitly covered in the CBRTHD exam objectives related to endpoint-based threat hunting.

Thus, Option B is the most accurate and Cisco-aligned answer.

Answer : B

The correct answer is behavioral analysis of outbound traffic patterns. Advanced attackers intentionally use standard protocols such as HTTP and HTTPS to blend exfiltration traffic with normal activity.

Hash-based and signature-based methods are ineffective because:

No malware may be present

Traffic appears legitimate

Infrastructure is frequently rotated

Behavioral analysis detects anomalies such as:

Unusual data transfer volumes

Abnormal session timing

Beaconing patterns

Rare destinations

This approach aligns with network threat hunting best practices and forces attackers to significantly alter behavior, increasing adversary cost.

Therefore, option B is correct.

Answer : A, C

The correct answers are A. Service and version of the web server and C. Technology used by the application. The error message shown in the exhibit is a classic example of verbose error handling, which unintentionally discloses sensitive internal details about the web application stack.

First, the error page explicitly references Apache Tomcat/6.0.16 at the bottom. This directly exposes the web server/service and its exact version, making Option A correct. From an attacker's perspective, this is valuable intelligence because it allows them to search for known vulnerabilities, exploits, or misconfigurations specific to that version of Tomcat. Older versions of Tomcat, in particular, have a long history of publicly documented security flaws.

Second, the stack trace references components such as:

org.apache.jasper.compiler.*

.jsp files (e.g., /user/left.jsp)

javax.servlet.http.HttpServlet

These details clearly reveal the technology stack used by the application, namely Java Server Pages (JSP) running on Apache Tomcat with Apache Jasper. This confirms Option C as correct. Exposing application technology helps attackers tailor attacks such as deserialization exploits, JSP injection attempts, or framework-specific vulnerabilities.

Option B is incorrect because the error message does not state or imply that Apache Jasper is vulnerable to path injection; it merely shows a compilation/runtime error. Option D is incorrect because the error page provides no information about the client-side browser version---all disclosed details relate to server-side processing.

From a professional security and threat hunting perspective, verbose error messages significantly increase attack surface visibility. Best practices dictate that production systems should return generic error messages to users while logging detailed stack traces internally. This scenario reinforces why proper error handling and information disclosure controls are critical defensive measures.

In summary, the penetration test error message exposes:

The web server service and version

The application technology stack

Therefore, the correct answers are A and C.