SY0-701 Question 391
Single answerThreat huntingA security analyst is conducting a threat-hunting exercise after a recent industry alert about attackers using stolen credentials to access VPN accounts and then moving laterally with legitimate administrative tools. The company has not received any confirmed alerts from its SIEM, but leadership wants the analyst to proactively look for signs of compromise. Which action would be the BEST first step in a threat-hunting workflow for this scenario?
- A
Create a hypothesis based on the reported adversary behavior, then query authentication, VPN, and endpoint logs for unusual logins and administrative tool execution patterns
- B
Immediately block all remote administrative tools across the environment to prevent any possible lateral movement
- C
Wait for the SIEM to generate a high-confidence alert before starting an investigation to avoid wasting resources
- D
Reimage systems used by administrators because legitimate tools indicate a likely insider threat
Show answer and explanation
Correct answer: A
Explanation
The best answer is to begin with a hypothesis-driven hunt based on current threat intelligence and observed attacker tradecraft. In Security+ terms, threat hunting is a proactive cybersecurity activity that assumes adversaries may already be present and seeks evidence of compromise even when no alert exists. A practical first step is to translate the industry alert into huntable indicators and behaviors, then examine logs and telemetry from relevant systems. For this scenario, strong sources include VPN and identity logs for suspicious access patterns and endpoint logs for lateral movement using legitimate administrative tools. This aligns with common best practices from frameworks and guidance such as MITRE ATT&CK, which emphasizes adversary behaviors and techniques, and NIST guidance on security monitoring and incident detection, which supports using logs and indicators to identify suspicious activity. The key distinction is that threat hunting is proactive, evidence-driven, and hypothesis-based, rather than immediately jumping to containment or waiting for automated alerts.
- A. Correct.
Correct. Threat hunting is a proactive activity that typically begins with a hypothesis informed by threat intelligence, known attacker TTPs, or environmental anomalies. In this case, the analyst should use the reported behavior as a starting point and search relevant data sources such as VPN logs, identity/authentication logs, and endpoint telemetry for patterns like unusual geolocations, impossible travel, abnormal login times, or suspicious execution of tools such as PowerShell, PsExec, WMI, or RDP activity. This reflects a structured hunting process rather than waiting for automated detection alone.
- B. Incorrect.
Incorrect. Blocking all remote administrative tools is a disruptive containment action, not the best first step in a hunt. Legitimate administrative tools are widely used for normal operations, and immediately disabling them could interrupt business processes. Threat hunting focuses first on gathering evidence and validating whether suspicious activity is present before broad containment decisions are made.
- C. Incorrect.
Incorrect. This reflects a misunderstanding of threat hunting. Hunting is specifically intended to proactively search for malicious activity that may not have triggered an alert. Waiting for a SIEM alert turns the process into reactive monitoring or incident response rather than a hunt.
- D. Incorrect.
Incorrect. Reimaging administrator systems without evidence is premature and not aligned with a threat-hunting workflow. The presence of legitimate tools alone does not indicate compromise or insider threat, because attackers often abuse native tools already present in the environment. The analyst should first collect evidence, validate the hypothesis, and determine scope before taking remediation actions.