300-220 Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity Practice Questions

While investigating an alert on a Windows domain member server, a forensic analyst correlates Sysmon and Windows PowerShell operational logs. The logs reveal that an obfuscated PowerShell script obtained a process handle to lsass.exe and invoked memory-dumping routines to extract credentials from LSASS memory, matching known APT28 tradecraft. When attributing this logged activity within the MITRE ATT&CK hierarchy, how is each component categorized?

To hunt for suspicious PowerShell warning events recorded since yesterday across Windows endpoints, a threat hunter executes the following command:

Get-WinEvent _____ @{ LogName='Windows PowerShell'; Level=3; StartTime=$Yesterday }

Which parameter completes the command to filter events using key/value pairs?

A defense contractor's threat hunting team is reconstructing a multi-stage intrusion timeline across an enclave of Windows engineering servers and network appliances. By correlating endpoint process logs, Windows Security event logs, and perimeter firewall telemetry, the team isolates four distinct chronological phases of adversary activity.

In Phase 1 (01:14 UTC), endpoint process logs on an engineering workstation show the execution of whoami /all, nltest /dclist:, and net group "Domain Admins" /domain to enumerate accounts and domain controllers. In Phase 2 (01:19 UTC), logs show the adversary tampering with the local EDR sensor pipeline and breaking log-forwarding mechanisms to blind security tooling. In Phase 3 (01:42 UTC), Windows authentication logs across three internal file servers record Network Logon events using stolen NTLM hashes (Pass-the-Hash) to pivot between systems.

In Phase 4 (02:15 UTC), firewall session logs record 4.2 GB of compressed archive files transferred over an encrypted channel to an external cloud storage host. The lead threat hunter must map Phases 1 through 4 in chronological order to the accurate MITRE ATT&CK Enterprise tactic identifiers for the attribution report. Which sequence is correct?

During a capability review of a regional bank's security operations center, a threat hunting lead maps the team's current detection practices against the Pyramid of Pain and the Threat Hunting Maturity Model. The team currently relies strictly on automated firewall and EDR rules that match known SHA-256 file hashes, static IP addresses, and domain names from external feeds, without collecting or analyzing host or network behavioral telemetry. Which statement accurately describes the operational impact of this posture?

While designing a roadmap to advance a healthcare provider's SOC to a higher phase of the Threat Hunting Maturity Model, a security architect evaluates how the team consumes threat intelligence across the Pyramid of Pain. The environment makes extensive administrative use of PowerShell for routine server maintenance. Recent threat intelligence indicates that a targeted adversary group abuses native PowerShell to execute credential harvesting without dropping custom binaries on disk. Which capability shift is required to effectively hunt and disrupt this adversary at the corresponding level of the Pyramid of Pain?

A global manufacturing enterprise is restructuring its cybersecurity defense program after a post-incident review revealed that a sophisticated intrusion went undetected for four months. Currently, the organization's security operations center relies on a SIEM that ingests perimeter firewall connection logs and endpoint antivirus hash alerts. Whenever the team receives a threat intelligence bulletin, analysts manually search the SIEM for the listed MD5 hashes, IP addresses, and domain names, representing a basic indicator-driven maturity phase.

During the four-month intrusion, the threat actor rotated C2 IP addresses every 12 hours, switched to newly registered domains every 48 hours, and padded binary payloads on each host to generate unique cryptographic file hashes. However, forensic reconstruction showed that the actor's implant consistently transmitted a custom HTTP User-Agent string containing an extra semicolon, created a specific Windows registry Run key pattern on compromised hosts, and laterally moved across servers using Pass-the-Hash authentication.

Executive leadership has mandated an architectural and procedural overhaul to advance the organization's Threat Hunting Maturity Model phase. The CISO requires the team to proactively uncover adversaries who evade atomic indicators and to operationalize successful hunts so analysts do not manually repeat identical data queries every week. Which strategy fulfills these requirements?