Free 300-220 sample questions

Correct answer: Unstructured threat hunting, which is data-driven and searches for anomalies in available data without starting from a hypothesis.

Unstructured threat hunting is a data-driven approach in which an analyst sifts through available data sources searching for anomalies without starting from a predefined hypothesis or following a set path. In contrast, structured threat hunting is hypothesis-based: a trigger initiates a hunting investigation abstract, a testable hypothesis is formulated first, and the hunt is scoped and executed toward a specific goal.

Correct answer: It provides insight into existing automated detection coverage so hunters do not waste effort duplicating threats already covered by operational monitoring rules.

Threat hunting aims to reduce the breach detection gap by uncovering threats that evade existing controls and introducing new or enhanced detection mechanisms. Consulting a use case management framework such as MaGMa provides clear visibility into what the SOC's automated monitoring rules already detect, ensuring hunters focus their hypotheses on uncovered blind spots rather than duplicating existing detections.

Correct answer: Classify entry 1 as a Meta Attack Pattern, entry 2 as a Standard Attack Pattern, and prioritize entry 3 as a Detailed Attack Pattern because it provides low-level technology specifics and a complete execution flow requiring targeted protection mechanisms.

MITRE CAPEC classifies attack patterns across three hierarchical levels of abstraction: `Meta Attack Pattern`, `Standard Attack Pattern`, and `Detailed Attack Pattern`. A `Meta Attack Pattern` (such as `CAPEC-212` Functionality Misuse) is an abstract characterization without specific technology or implementation details, suited for high-level architecture and design threat modeling. A `Standard Attack Pattern` specializes a Meta pattern into a specific methodology forming a single component of an attack. A `Detailed Attack Pattern` provides low-level specifics targeting a particular technology, describes a complete execution flow, and requires specific technical protection mechanisms to mitigate on production systems. graph TD Cat["Category: Abuse Existing Functionality (210)"] --> Meta["Meta Attack Pattern (e.g., CAPEC-212 Functionality Misuse) Abstract methodology; no technology specifics"] Meta --> Std["Standard Attack Pattern Specific methodology; single attack component"] Std --> Det["Detailed Attack Pattern (e.g., CAPEC-229) Low-level technology specifics; complete execution flow"]

Correct answer: Tactic: `TA0006` Credential Access; Technique: OS Credential Dumping; Sub-technique: LSASS Memory; Procedure: `APT28` using PowerShell to inject into `lsass.exe` and dump credentials.

In MITRE ATT&CK, `tactics` represent the high-level adversary objective (`TA0006` Credential Access), `techniques` represent the behavior used to achieve that objective (`OS Credential Dumping`), and `sub-techniques` break the technique down into more specific actions (`LSASS Memory`, as distinct from `Security Account Manager` or `/etc/passwd` and `/etc/shadow`). `Procedures` describe the specific real-world implementation executed by a threat actor, such as `APT28` using PowerShell to access `lsass.exe` memory.

Correct answer: -FilterHashtable

In PowerShell, the `Get-WinEvent` cmdlet uses the `-FilterHashtable` parameter to accept a hashtable (`@{ ... }`) of key/value pairs such as `LogName`, `Level`, `Id`, and `StartTime` to efficiently query Windows event logs. `-FilterXPath` and `-FilterXml` require XPath expressions or structured XML strings rather than a PowerShell hashtable.

Correct answer: `TA0007` (Discovery) -> `TA0112` (Defense Impairment) -> `TA0008` (Lateral Movement) -> `TA0010` (Exfiltration)

Mapping the logged behaviors chronologically to the MITRE ATT&CK Enterprise tactics yields: Phase 1 (`whoami`, `nltest`, `net group` to learn about the environment) maps to `TA0007` (`Discovery`); Phase 2 (breaking security mechanisms, telemetry pipelines, and EDR tooling) maps to `TA0112` (`Defense Impairment`); Phase 3 (pivoting across internal servers via Pass-the-Hash) maps to `TA0008` (`Lateral Movement`); and Phase 4 (stealing 4.2 GB of archived data out of the network) maps to `TA0010` (`Exfiltration`).