300-220 Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity 300-220 CBRTHD Questions and Answers

The correct answer isit reveals operational discipline and intent. Attribution relies heavily on understandinghow attackers think and operate, not just the tools they use.

Operational discipline—such as careful reconnaissance, avoiding noisy exploitation, and operating during business hours—is ahuman behavioral pattern. These patterns are far more stable than infrastructure or malware and often correlate strongly with specific threat actor groups.

Option A and D focus on tooling, which changes frequently. Option B relates to persistence, not attribution.

Threat intelligence professionals use operational characteristics to distinguish between opportunistic criminals and advanced adversaries. Business-hour activity, careful lateral movement, and deliberate escalation often indicatetargeted intrusions, espionage, or financially motivated but sophisticated actors.

This information helps analysts align observed behavior with known threat actor profiles, improving attribution confidence. Thus, optionCis correct.

The correct answer isdetecting abnormal authentication behavior across VPN and cloud access. This outcome targetsbehavioral detection, which sits significantly higher on the Pyramid of Pain than static indicators.

Options A and C rely on domains and hashes, which attackers can trivially change. Option D is a response action, not a hunting outcome.

Credential misuse is one of themost common initial access vectors, especially in cloud and remote-access environments. Detecting abnormal authentication behavior—such as:

Impossible travel

Unusual login times

Excessive failed logins

Geographic anomalies

forces attackers tochange how they operate, not just what infrastructure they use.

Cisco tools such as:

Secure Network Analytics

Secure Endpoint

Secure Firewall

Identity telemetry via VPN and SSO

enable this higher-fidelity detection approach. This aligns directly withCBRTHD blueprint objectivesfocused onidentity-based threat hunting.

Therefore,Option Bis correct.

The correct answers areB. Processes in nonstandard file pathsandC. Common processes with modified names. These two detection rules are highly effective for identifyingmalicious processes spawned by phishing-delivered malware.

Phishing payloads commonly drop executables intononstandard directoriessuch as AppData, Temp, Downloads, or user profile subfolders. Legitimate Windows binaries rarely execute from these locations. Monitoring for process execution from such paths is a proven technique for detecting malware loaders, credential stealers, and post-exploitation tooling.

Additionally, attackers frequentlymasquerade malware as legitimate processesby using slightly modified names, such as lsasss.exe, svch0st.exe, or expl0rer.exe. These tactics are designed to evade casual inspection and basic allowlisting. Detecting common Windows process names with anomalies—such as incorrect spelling, unexpected parent processes, or abnormal execution paths—is a high-fidelity behavioral signal.

Option A is too broad; nearly all processes are created by users directly or indirectly, making it noisy. Option D (process ownership changes) and Option E (startup time changes) are less relevant to detecting credential-harvesting processes at execution time and may miss the initial malicious activity.

From a threat hunting and detection engineering perspective, optionsB and Calign withMITRE ATT&CK – Defense Evasion and Credential Accesstechniques. These rules focus onbehavioral detection, not static indicators, making them resilient against attacker variation.

In short, detectingwhere a process runs fromandwhat it pretends to beprovides strong coverage against phishing-delivered malware, makingB and Cthe correct and professionally validated choices.

The correct answer isStructured threat hunting. In this scenario, the SOC team has alreadyconfirmed malicious activity—a compromised user account, anomalous VPN access, and indicators consistent with data exfiltration. Once an incident has been validated and attributed to adversary behavior, the next professional step is to performstructured threat huntingto uncover additional attacker actions across the environment.

Structured threat hunting ishypothesis-drivenand based on known attacker tactics, techniques, and procedures (TTPs), often mapped to frameworks such asMITRE ATT&CK. Here, the team can form hypotheses like:“If the adversary accessed the file server for exfiltration, they may have also attempted lateral movement, persistence, or privilege escalation.”Analysts then systematically query endpoint, identity, VPN, file server, and network telemetry to confirm or disprove these hypotheses.

Option A (Unstructured) is typically used at the earliest stages when little is known and analysts are exploring weak signals or anomalies without a defined adversary model. That phase has already passed in this case. Option B (AI-driven) refers to tooling or analytics methods rather than a threat hunting methodology. Option C (Proactive) is a general mindset applied to all hunting activities, not a specific hunting type used to investigate known attacker behavior.

From a professional SOC and threat hunting perspective, structured hunting enablesfull attack chain reconstruction. It helps identify secondary objectives such as data staging locations, additional compromised accounts, persistence mechanisms, and command-and-control activity. The outcome is a more complete understanding of the breach, improved containment, and stronger detection logic for future incidents.

This approach reflects mature security operations:once compromise is confirmed, hunt the adversary—not just the alert. Structured threat hunting ensures attackers are fully evicted and prevents repeat compromise through overlooked footholds.

The correct answer isbehavioral analysis of outbound traffic patterns. Advanced attackers intentionally usestandard protocols such as HTTP and HTTPSto blend exfiltration traffic with normal activity.

Hash-based and signature-based methods are ineffective because:

No malware may be present

Traffic appears legitimate

Infrastructure is frequently rotated

Behavioral analysis detects anomalies such as:

Unusual data transfer volumes

Abnormal session timing

Beaconing patterns

Rare destinations

This approach aligns withnetwork threat hunting best practicesand forces attackers to significantly alter behavior, increasing adversary cost.

Therefore, optionBis correct.

The correct answer isUse Deep Packet Inspection (DPI) to block malicious domains. The key detail in this scenario is that the endpoint is makingcontinuous outbound TCP connections to a known Command-and-Control (C2) server over port 80, which strongly indicates active malware beaconing or payload retrieval.

Deep Packet Inspection enables security controls—such as next-generation firewalls or network security analytics platforms—to inspectapplication-layer content, including HTTP headers, URLs, domains, and payload characteristics. This allows defenders to block C2 communicationbased on domain names, URL patterns, or behavioral signatures, even if attackers change IP addresses. Since C2 infrastructure is frequently rotated, IP-based blocking alone is insufficient for long-term mitigation.

Option A (browser extension deny list) may help prevent a specific initial infection vector, but it does not addresspost-compromise C2 traffic, especially if malware communicates independently of the browser. Option B (antivirus quarantine) is reactive and limited by signature coverage; modern malware often evades AV detection. Option D (IDS) can detect similar connections but typically does notblocktraffic unless integrated with an IPS or firewall, making it less effective for mitigation.

From a professional threat hunting and SOC standpoint, blocking C2 communication at thenetwork layer using DPIis a high-impact defensive control. It disrupts attacker command channels, prevents data exfiltration, and buys time for endpoint remediation and forensic investigation.

This aligns withMITRE ATT&CK – Command and Control (TA0011)mitigation strategies and reflects a mature security posture:detect at the endpoint, disrupt at the network. Therefore, optionCis the most effective action to mitigate similar connections in the future.

The correct answer isinternal systems authenticating to multiple hosts using SMB in a short time. This behavior is a classic indicator ofcredential-based lateral movement.

When attackers obtain valid credentials, they often move laterally by:

Accessing administrative shares (e.g., C$, ADMIN$)

Using SMB, WMI, WinRM, or RDP

Authenticating to multiple systems rapidly

Cisco Secure Network Analytics excels at identifyingeast-west traffic anomalies, which are central to lateral movement detection. A single host authenticating to many internal systems over SMB in a short time deviates strongly from normal user behavior.

Option A relates to external traffic, not lateral movement. Option C may indicate command-and-control or staging but not lateral movement. Option D aligns more with beaconing behavior.

This technique aligns withMITRE ATT&CK – Lateral Movementand is explicitly covered in theCBRTHD blueprintunder network-based threat hunting.

Thus,Option Bis the correct answer.

Thepass-the-hash (PtH)technique is classified underCredential Accessin the MITRE ATT&CK framework. Specifically, it aligns with theCredential Access tactic (TA0006)and the techniqueUse Alternate Authentication Material (T1550), sub-techniquePass the Hash (T1550.002). This classification is based on the attacker’s primary objective: abusing stolen credential material—in this case, NTLM password hashes—to authenticate to systems without knowing the actual plaintext password.

From a professional cybersecurity and threat hunting perspective, PtH exploits weaknesses in how Windows authentication mechanisms handle credential storage and reuse. When users authenticate to a system, password hashes may be cached in memory or stored in places such as LSASS (Local Security Authority Subsystem Service). If an attacker gains administrative or SYSTEM-level access to a host, they can extract these hashes and reuse them to authenticate to other systems across the environment.

Although pass-the-hash isoften observed during lateral movement, MITRE intentionally classifies it underCredential Accessbecause the defining action is thetheft and misuse of credential material, not the movement itself. Lateral movement is a downstream outcome enabled by the stolen credentials, but the core technique is about accessing and abusing authentication secrets.

This distinction is important for threat hunters and detection engineers. When hunting for PtH activity, defenders focus on indicators such as abnormal NTLM authentication events, logons using NTLM where Kerberos is expected, reuse of the same hash across multiple systems, and suspicious access to LSASS memory. Endpoint telemetry, Windows Security Event Logs (e.g., Event IDs 4624 and 4672), and EDR memory access alerts are commonly used data sources.

Understanding PtH as acredential access techniquehelps security teams prioritize protections such as credential guard, LSASS hardening, disabling NTLM where possible, enforcing least privilege, and monitoring authentication anomalies. This classification also reinforces a core professional principle:identity is the new perimeter, and protecting credential material is foundational to modern threat hunting and defense.

The correct answer isauthentication and remote execution logs. Lateral movement using legitimate tools relies heavily oncredential use and remote management protocols, not malware execution.

Attackers commonly use:

RDP

SMB administrative shares

WinRM

WMI

SSH

These techniques generateauthentication events, remote logons, and service execution logsrather than malware alerts. Antivirus tools are ineffective here because no malicious binaries are involved.

Option A is ineffective against living-off-the-land attacks. Option B is unrelated to lateral movement. Option D may show some activity but lacks the necessary depth to identify privilege misuse or session hopping.

Authentication telemetry enables hunters to detect anomalies such as:

Logons between non-associated systems

Sudden administrative access

Credential reuse across hosts

Abnormal session timing and frequency

This data is foundational forcredential-based attack detection, which remains one of the most common breach paths today. It also aligns withMITRE ATT&CK Lateral Movement and Credential Access tactics.

Thus, optionCis the correct answer.

The correct answer isit reflects the attacker’s operational preferences. Attribution relies on understandinghow attackers operate, not just what tools they use.

Operational preferences—such as avoiding PowerShell logging, disabling AMSI, and favoring WMI—arebehavioral signatures. These patterns often persist across campaigns and are documented in threat intelligence reports associated with specific adversaries.

Option A is incorrect because malware families change frequently. Option B is unreliable due to infrastructure rotation. Option D is unrelated to post-access tradecraft.

Professional attribution focuses on:

Execution methods

Defensive evasion choices

Tooling preferences

Workflow consistency

Mapping these behaviors toMITRE ATT&CK techniquesenables analysts to compare findings against known threat actor profiles. This provides higher confidence attribution than artifact-based indicators.

Thus, optionCis the correct answer.

The correct answer isCollect and process intelligence and data. In this scenario, theinitial threat hunting phaseoccurred when the SOC team received the alert and began analyzing SIEM logs to validate whether the activity was legitimate or malicious. This aligns directly with the first phase of the threat hunting lifecycle, which focuses on gathering, normalizing, and analyzing security-relevant data.

Threat hunting is a structured, hypothesis-driven process, but it always begins withdata collection and intelligence processing. This includes ingesting logs from identity providers, authentication systems, cloud platforms, VPNs, and endpoint telemetry into a SIEM. In this case, the alert regarding a sign-in from an unusual country triggered analysts to examine historical login patterns and geolocation data. By confirming that the user had never authenticated from that country, the team established that the event was anomalous and likely malicious.

Option B (Response and resolution) occurredafterthe initial phase, when the IT administrator reset the user’s password to contain the threat. Option C (Hypothesis) would involve formulating a theory such as “the account may be compromised due to credential theft,” but this step requires validated data first. Option D (Post-incident review) only happens after the incident has been fully resolved and lessons learned are documented.

From a professional cybersecurity operations perspective, this phase is critical becausehigh-quality data determines hunt effectiveness. Poor log coverage or incomplete identity telemetry would prevent analysts from confidently confirming the anomaly. This example also highlights why identity-related telemetry is foundational to modern threat hunting—compromised credentials remain one of the most common initial access vectors.

In short, before a SOC can hypothesize, respond, or improve controls, it must firstcollect and process accurate intelligence and data, making option A the correct answer.

The correct answer isit reveals consistent attacker tradecraft across incidents. Attribution relies onbehavioral consistency, not on malware samples or exploits.

Avoiding malware and abusing legitimate tools (living-off-the-land techniques) reflects adeliberate operational strategy. These behaviors tend to remain consistent across campaigns and are frequently documented in threat intelligence profiles.

Options A and D are incorrect because no exploit or ransomware is involved. Option B is incorrect; living-off-the-land techniques are modern, not outdated.

Cisco-aligned threat hunting emphasizesMITRE ATT&CK mappingand behavioral analysis to support attribution efforts. This approach is far more reliable than artifact-based attribution.

Thus,Option Cis the correct answer.

The correct answer isreduction in attacker dwell time. Dwell time measures how long an attacker remains undetected in the environment.

As threat hunting maturity increases:

Detection becomes faster

Behavioral coverage improves

Attackers are identified earlier in the kill chain

Metrics such as alert volume or blocked IPs (Options A and D) do not reflect effectiveness and may even indicate excessive noise. Option B measures inputs, not outcomes.

Cisco’sCBRTHD blueprintfocuses onoutcomes, not activity. Reduced dwell time demonstrates:

Effective hunting

Better visibility

Stronger detection engineering

This metric directly correlates with reduced breach impact and improved resilience.

Therefore,Option Cis the correct and Cisco-aligned answer.

The correct answer isConnection status. In this scenario, the key challenge for the security team is differentiatinglegitimate outbound trafficfrommalicious or DDoS-related trafficoriginating from the same web server. Since both types of traffic coexist in the logs, analysts must rely on an attribute that meaningfully distinguishes normal behavior from abnormal patterns.

The exhibit shows numerous TCP connections from the web server to many different external IP addresses, with varyingTCP statessuch as ESTABLISHED, TIME_WAIT, and FIN_WAIT. These connection states are highly valuable for threat hunting and network analysis. During DDoS activity—especially reflected or amplification-style attacks, or when a server is abused as part of an attack—connections often remain half-open, rapidly transition to TIME_WAIT, or fail to fully establish. In contrast, legitimate web traffic typically results in stable, short-lived ESTABLISHED sessions that follow predictable patterns.

Option B (destination port) is not useful here because most web traffic—both legitimate and malicious—commonly uses ports 80 or 443. Option C (IP address of the web server) provides no filtering value because all traffic already originates from that server. Option D (protocol) is also ineffective, as both normal and DDoS traffic in this case use TCP.

From a professional SOC and threat hunting standpoint,connection state analysisis a foundational technique for detecting volumetric attacks, beaconing behavior, and abnormal session churn. By filtering logs based on connection status, analysts can quickly isolate suspicious patterns such as excessive short-lived connections, abnormal teardown behavior, or asymmetric session states that are characteristic of DDoS-related activity.

This approach aligns with mature threat hunting practices:when indicators overlap, pivot to behavioral attributes. Connection status provides the necessary behavioral signal to separate expected traffic from attack traffic and supports faster, more accurate incident response.

The correct answer isAttack trees. Attack trees are uniquely suited for modelingmulti-step adversary behavior, which is essential when analyzing complex attack chains such as account takeover followed by data exfiltration.

Attack trees begin with ahigh-level attacker goal(for example, “Exfiltrate customer data”) and then break that goal into multiple branches representing different paths an attacker could take. These paths can include credential compromise, API abuse, privilege escalation, lateral movement, and persistence. This structure mirrors how real adversaries think and operate.

Option A (STRIDE) is useful for identifying broad threat categories—such as spoofing, tampering, or information disclosure—but it does not naturally capturesequential attack paths. Option B (CVSS) focuses on vulnerability severity scoring, not adversary behavior. Option D (DREAD) assesses risk impact but does not visualize how attacks unfold across systems.

For threat hunters and defenders, attack trees provide ashared mental modelbetween architects, SOC teams, and red teams. They directly inform detection engineering by highlightingcritical choke pointswhere attacker behavior must occur, such as token abuse, API enumeration, or anomalous role assumption in cloud environments.

In modern cloud security, where breaches often involvemultiple low-severity issues chained together, attack trees offer far greater strategic value than component-by-component analysis. They also align closely withMITRE ATT&CK mapping, enabling defenders to translate threat models into actionable hunts.

Thus, optionCis the most appropriate and professionally validated answer.