Cisco Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity 300-220 CBRTHD Exam Questions

Answer : C, E

The correct answers are Use of Windows Remote Management (C) and Use of tools and commands to connect to remote shares (E). Both are core mechanisms attackers leverage for lateral movement after gaining valid credentials through techniques such as pass-the-hash or pass-the-ticket.

Windows Remote Management (WinRM) is a legitimate administrative service used for remote command execution and system management. However, attackers frequently abuse WinRM to move laterally by executing commands on remote endpoints using stolen credentials. From a threat hunting perspective, abnormal WinRM usage---such as execution outside normal administrative hours, from unusual source hosts, or by non-administrative user accounts---is a strong indicator of lateral movement activity.

Similarly, the use of tools and commands to connect to remote shares (such as net use, wmic, SMB-based access, or mounting administrative shares like C$) is a classic lateral movement technique. Attackers use remote shares to transfer tools, stage payloads, and execute malware across systems. Monitoring these activities at the endpoint level helps identify suspicious authentication attempts, unexpected share access, and abnormal file transfers.

Option A (runas) relates more to privilege escalation than lateral movement. Option B is specific to Linux privilege persistence and is not relevant to endpoint lateral movement hunting in this context. Option D (scheduled task creation) is primarily associated with persistence rather than movement between systems.

By monitoring WinRM activity and remote share usage, security teams gain visibility into credential-based movement, which remains one of the most common and dangerous attacker behaviors in enterprise environments. Effective lateral movement hunting focuses on how credentials are used, not just how they are stolen.

Answer : C

The correct answer is Attack trees. Attack trees are uniquely suited for modeling multi-step adversary behavior, which is essential when analyzing complex attack chains such as account takeover followed by data exfiltration.

Attack trees begin with a high-level attacker goal (for example, ''Exfiltrate customer data'') and then break that goal into multiple branches representing different paths an attacker could take. These paths can include credential compromise, API abuse, privilege escalation, lateral movement, and persistence. This structure mirrors how real adversaries think and operate.

Option A (STRIDE) is useful for identifying broad threat categories---such as spoofing, tampering, or information disclosure---but it does not naturally capture sequential attack paths. Option B (CVSS) focuses on vulnerability severity scoring, not adversary behavior. Option D (DREAD) assesses risk impact but does not visualize how attacks unfold across systems.

For threat hunters and defenders, attack trees provide a shared mental model between architects, SOC teams, and red teams. They directly inform detection engineering by highlighting critical choke points where attacker behavior must occur, such as token abuse, API enumeration, or anomalous role assumption in cloud environments.

In modern cloud security, where breaches often involve multiple low-severity issues chained together, attack trees offer far greater strategic value than component-by-component analysis. They also align closely with MITRE ATT&CK mapping, enabling defenders to translate threat models into actionable hunts.

Thus, option C is the most appropriate and professionally validated answer.

Answer : C

The correct answer is formulating a hypothesis to search for credential misuse without alerts. This activity is the defining characteristic of threat hunting.

Threat hunting is proactive and hypothesis-driven, meaning analysts intentionally search for attacker behavior that has not yet triggered alerts. Detection engineering, on the other hand, focuses on building and tuning automated rules that respond to known patterns.

Options A, B, and D all represent reactive or preventative security operations. They rely on known indicators or alerts and are foundational but insufficient against stealthy adversaries who abuse valid credentials and native tools.

Cisco's CBRTHD blueprint explicitly emphasizes hypothesis-based hunting as a core competency. Hunters ask questions like:

''If credentials were stolen, how would that look in our telemetry?''

''What behavior would indicate lateral movement without malware?''

This approach aligns with detecting Indicators of Attack (IOAs) and operating higher on the Pyramid of Pain, forcing adversaries to change tactics instead of infrastructure.

Therefore, Option C is the correct and Cisco-aligned answer.

Answer : B, C

The correct answers are B. Processes in nonstandard file paths and C. Common processes with modified names. These two detection rules are highly effective for identifying malicious processes spawned by phishing-delivered malware.

Phishing payloads commonly drop executables into nonstandard directories such as AppData, Temp, Downloads, or user profile subfolders. Legitimate Windows binaries rarely execute from these locations. Monitoring for process execution from such paths is a proven technique for detecting malware loaders, credential stealers, and post-exploitation tooling.

Additionally, attackers frequently masquerade malware as legitimate processes by using slightly modified names, such as lsasss.exe, svch0st.exe, or expl0rer.exe. These tactics are designed to evade casual inspection and basic allowlisting. Detecting common Windows process names with anomalies---such as incorrect spelling, unexpected parent processes, or abnormal execution paths---is a high-fidelity behavioral signal.

Option A is too broad; nearly all processes are created by users directly or indirectly, making it noisy. Option D (process ownership changes) and Option E (startup time changes) are less relevant to detecting credential-harvesting processes at execution time and may miss the initial malicious activity.

From a threat hunting and detection engineering perspective, options B and C align with MITRE ATT&CK -- Defense Evasion and Credential Access techniques. These rules focus on behavioral detection, not static indicators, making them resilient against attacker variation.

In short, detecting where a process runs from and what it pretends to be provides strong coverage against phishing-delivered malware, making B and C the correct and professionally validated choices.

Answer : A

The correct answer is Collect and process intelligence and data. In this scenario, the initial threat hunting phase occurred when the SOC team received the alert and began analyzing SIEM logs to validate whether the activity was legitimate or malicious. This aligns directly with the first phase of the threat hunting lifecycle, which focuses on gathering, normalizing, and analyzing security-relevant data.

Threat hunting is a structured, hypothesis-driven process, but it always begins with data collection and intelligence processing. This includes ingesting logs from identity providers, authentication systems, cloud platforms, VPNs, and endpoint telemetry into a SIEM. In this case, the alert regarding a sign-in from an unusual country triggered analysts to examine historical login patterns and geolocation data. By confirming that the user had never authenticated from that country, the team established that the event was anomalous and likely malicious.

Option B (Response and resolution) occurred after the initial phase, when the IT administrator reset the user's password to contain the threat. Option C (Hypothesis) would involve formulating a theory such as ''the account may be compromised due to credential theft,'' but this step requires validated data first. Option D (Post-incident review) only happens after the incident has been fully resolved and lessons learned are documented.

From a professional cybersecurity operations perspective, this phase is critical because high-quality data determines hunt effectiveness. Poor log coverage or incomplete identity telemetry would prevent analysts from confidently confirming the anomaly. This example also highlights why identity-related telemetry is foundational to modern threat hunting---compromised credentials remain one of the most common initial access vectors.

In short, before a SOC can hypothesize, respond, or improve controls, it must first collect and process accurate intelligence and data, making option A the correct answer.

Answer : B

The correct answer is document findings and operationalize detections. In Cisco's threat hunting methodology, confirmation of malicious activity is not the end of the hunt.

The most critical next step is to:

Document attacker behavior

Identify detection gaps

Create or improve SIEM, EDR, or NDR detection rules

This ensures the organization does not repeatedly rediscover the same threat. Options C and D are incident response and communication activities, not threat hunting lifecycle steps. Option A skips the crucial improvement phase.

The CBRTHD blueprint strongly emphasizes:

Continuous improvement

Feedback loops

Detection engineering

By operationalizing findings, the SOC increases maturity and forces adversaries to change tactics.

Therefore, Option B is correct.

Answer : B

The correct answer is correlating attacker behavior across multiple MITRE ATT&CK techniques. This approach focuses on behavioral detection, which is the cornerstone of effective threat hunting and advanced security operations.

Attackers who abuse legitimate administrative tools---often referred to as living-off-the-land techniques---intentionally avoid malware-based detections. File hashes, signatures, and known indicators provide minimal value because there may be no malicious files at all. Options A and D sit at the lowest levels of the Pyramid of Pain, making them easy for adversaries to evade.

By correlating behavior across multiple ATT&CK techniques---such as credential access, lateral movement, privilege escalation, and command execution---defenders detect how the attacker operates rather than what tools they use. This forces adversaries to fundamentally change tradecraft, which is costly, risky, and time-consuming.

Option C improves visibility but does not inherently raise attacker cost. Threat intelligence feeds are reactive and often lag behind active campaigns.

From a professional threat hunting perspective, correlating multiple low-signal behaviors into a high-confidence attack pattern is how mature SOCs detect stealthy intrusions. This method also supports scalable detection engineering, improved alert fidelity, and reduced false positives.

This strategy directly aligns with higher tiers of the Threat Hunting Maturity Model and the top of the Pyramid of Pain, making option B the correct answer.