300-220 Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity 300-220 CBRTHD Question and Answers

The correct answer isit reflects the attacker’s operational preferences. Attribution relies on understandinghow attackers operate, not just what tools they use.

Operational preferences—such as avoiding PowerShell logging, disabling AMSI, and favoring WMI—arebehavioral signatures. These patterns often persist across campaigns and are documented in threat intelligence reports associated with specific adversaries.

Option A is incorrect because malware families change frequently. Option B is unreliable due to infrastructure rotation. Option D is unrelated to post-access tradecraft.

Professional attribution focuses on:

Execution methods

Defensive evasion choices

Tooling preferences

Workflow consistency

Mapping these behaviors toMITRE ATT&CK techniquesenables analysts to compare findings against known threat actor profiles. This provides higher confidence attribution than artifact-based indicators.

Thus, optionCis the correct answer.

The correct answer isDiscovery of unknown attacker behaviors and closure of detection gaps. This outcome best reflects thestrategic valueof threat hunting beyond incident response.

Threat hunting is not primarily about cleanup actions such as credential resets or file removal—those areincident response tasks. The real value of hunting lies in uncoveringpreviously undetected attacker behaviors, understanding how adversaries bypass controls, and translating those findings intoimproved detection and prevention.

Option A represents low-value indicators that attackers can easily change. Option C assumes malware was involved, which is not the case. Option D is necessary but tactical, not strategic.

By identifying credential misuse patterns, lateral movement paths, and data exfiltration techniques, the team can:

Create new SIEM and EDR detections

Harden identity and access controls

Reduce dwell time for future intrusions

Force attackers higher up the Pyramid of Pain

This demonstratesorganizational resilience, not just containment. Mature security programs measure success by how effectively theyeliminate blind spots, not how many alerts they close.

Thus, optionBis the correct answer.

The correct answer isThey produce false positives and false negatives. Automated dynamic malware analysis tools, such as sandboxes, execute suspicious files in isolated environments to observe runtime behavior. While these tools are extremely valuable in modern SOCs, they are not infallible and have well-known limitations.

False positives occur when benign software exhibits behaviors that resemble malicious activity, such as creating registry keys, spawning child processes, or making network connections. Conversely, false negatives occur when malware intentionallyevades detectionby altering its behavior. Many modern malware samples include sandbox evasion techniques such as checking for virtualized environments, delaying execution, requiring user interaction, or disabling malicious functionality when analysis artifacts are detected.

Option A is incorrect because dynamic analysis can, in fact, uncover runtime vulnerabilities and exploit behavior. Option C is misleading; while tooling coverage varies, language support is not the primary limitation. Option D refers tomanual analysis, whereas the question explicitly addresses automated tools.

From a threat hunting and malware analysis standpoint, professionals understand that sandbox results must becorrelated with other telemetry, including endpoint behavior, network traffic, and threat intelligence. Automated tools are best used as part of a layered analysis strategy, not as a single source of truth.

This limitation reinforces a core security principle:automation accelerates detection, but human judgment validates impact. Skilled analysts interpret sandbox results, investigate anomalies, and determine real-world risk. Understanding the strengths and weaknesses of dynamic analysis tools allows SOC teams to avoid overreliance on automation while still benefiting from its speed and scale.

The correct answer iscorrelating attacker behavior across multiple MITRE ATT&CK techniques. This approach focuses onbehavioral detection, which is the cornerstone of effective threat hunting and advanced security operations.

Attackers who abuse legitimate administrative tools—often referred to asliving-off-the-land techniques—intentionally avoid malware-based detections. File hashes, signatures, and known indicators provide minimal value because there may beno malicious files at all. Options A and D sit at the lowest levels of thePyramid of Pain, making them easy for adversaries to evade.

By correlating behavior across multiple ATT&CK techniques—such as credential access, lateral movement, privilege escalation, and command execution—defenders detecthowthe attacker operates rather thanwhat toolsthey use. This forces adversaries to fundamentally change tradecraft, which is costly, risky, and time-consuming.

Option C improves visibility but does not inherently raise attacker cost. Threat intelligence feeds are reactive and often lag behind active campaigns.

From a professional threat hunting perspective, correlating multiple low-signal behaviors into ahigh-confidence attack patternis how mature SOCs detect stealthy intrusions. This method also supports scalable detection engineering, improved alert fidelity, and reduced false positives.

This strategy directly aligns with higher tiers of theThreat Hunting Maturity Modeland the top of thePyramid of Pain, making optionBthe correct answer.

The correct answer isendpoint process ancestry tracking. Credential harvesting attacks frequently rely onfileless executionand living-off-the-land techniques.

When no files are written to disk, hash-based detection (Option A) is ineffective. Email sandboxing (Option C) and URL filtering (Option D) may detect initial delivery but provide little visibility into post-execution behavior.

Cisco Secure Endpoint provides detailed telemetry on:

Parent-child process relationships

Unexpected process spawning

Abnormal command-line arguments

Memory-resident execution

By analyzing process ancestry, hunters can identify suspicious chains such as:

Office applications spawning scripting engines

Browsers spawning credential-harvesting processes

Legitimate binaries launching unexpected child processes

This capability directly supportsMITRE ATT&CK Credential Access and Defense Evasion techniquesand is explicitly covered in theCBRTHD exam objectivesrelated to endpoint-based threat hunting.

Thus,Option Bis the most accurate and Cisco-aligned answer.

The correct answer isdocumenting findings and updating detection logic. This represents thepost-hunt operationalization phase, which is critical for long-term security improvement.

While options A and C are necessary response actions, they address only thecurrent incident. Threat hunting’s strategic value comes from transforming discoveries intorepeatable detections, playbooks, and controls.

Professional threat hunting programs ensure that:

Successful hunts produce new SIEM rules

Detection gaps are closed

Findings are documented for future analysts

Lessons learned inform security architecture decisions

Option D continues exploration but fails to institutionalize knowledge. Without operationalizing results, organizations repeatedly rediscover the same threats.

This phase directly increases maturity in theThreat Hunting Maturity Model, shifting organizations from hero-driven hunting to scalable, resilient detection. It also moves defendersup the Pyramid of Pain, forcing adversaries to change tactics rather than indicators.

Therefore, optionBis the correct and most strategically important answer.

The correct answer isanalyzing abnormal behavior patterns across identity, endpoint, and network telemetry. This approach represents the foundation of modern threat hunting and directly addresses adversaries who deliberately avoid traditional detections.

Advanced attackers increasingly rely onliving-off-the-land techniques, stolen credentials, and legitimate administrative tools such as PowerShell, WMI, RDP, and cloud APIs. These activities rarely generate malware signatures or known IOCs, making alert-driven and signature-based defenses insufficient. As a result, mature threat hunting programs shift focus towardbehavioral analysis and anomaly detection.

Option A and D rely on static indicators such as IPs, domains, and hashes. These sit at thelowest levels of the Pyramid of Painand are trivial for attackers to change. Option B is purely reactive and limited to known malware, offering little value against stealthy intrusions.

By correlating identity logs (authentication patterns, geolocation anomalies), endpoint telemetry (process execution, parent-child relationships), and network activity (unusual connections, lateral movement patterns), hunters can detectIndicators of Attack (IOAs)rather than waiting for confirmed compromise. This enables identification of credential misuse, privilege abuse, and lateral movement even when no malware is present.

This methodology aligns withMITRE ATT&CK TTP-based hunting, which focuses on tactics and techniques instead of tools or infrastructure. It also reflects a higher tier in theThreat Hunting Maturity Model, where organizations proactively search for unknown threats rather than responding to alerts.

In professional SOC environments, this shift dramatically increases detection coverage against advanced adversaries and reduces dwell time. Therefore, optionCis the most accurate and strategically sound answer.

The correct answer isdetecting abnormal authentication behavior across VPN and cloud access. This outcome targetsbehavioral detection, which sits significantly higher on the Pyramid of Pain than static indicators.

Options A and C rely on domains and hashes, which attackers can trivially change. Option D is a response action, not a hunting outcome.

Credential misuse is one of themost common initial access vectors, especially in cloud and remote-access environments. Detecting abnormal authentication behavior—such as:

Impossible travel

Unusual login times

Excessive failed logins

Geographic anomalies

forces attackers tochange how they operate, not just what infrastructure they use.

Cisco tools such as:

Secure Network Analytics

Secure Endpoint

Secure Firewall

Identity telemetry via VPN and SSO

enable this higher-fidelity detection approach. This aligns directly withCBRTHD blueprint objectivesfocused onidentity-based threat hunting.

Therefore,Option Bis correct.

The correct answer isFiles are encrypted. The exhibit shows a collection of API calls and strings that strongly indicatecryptographic operations associated with file encryption, a common behavior in ransomware and data-encrypting malware.

Key indicators in the script include multiple Windows Cryptographic API function calls such as:

CryptAcquireContextW

CryptCreateHash

CryptHashData

CryptDeriveKey

CryptEncrypt

CryptDecrypt

CryptDestroyKey

CryptReleaseContext

These APIs are part of theWindows CryptoAPI, which is explicitly used to generate cryptographic keys, hash data, and encrypt or decrypt content. The presence of ADVAPI32.dll further confirms cryptographic functionality, as this library provides access to Windows security and encryption services.

Additionally, registry-related APIs such as RegSetValueExA, RegOpenKeyExA, and references to:

Software\Microsoft\Windows\CurrentVersion\Run

indicate that the script may also establishpersistence, ensuring the encryption routine executes again after reboot. However, persistence is secondary; the primary functional behavior shown is encryption.

Option A is incorrect because there are no APIs related to disabling networking (such as InternetSetOption or firewall manipulation). Option B is incorrect because retrieving host version information would involve system query APIs like GetVersionEx, which are not present. Option C is incorrect because although the word sleep appears, it is commonly used by malware to delay execution or evade sandboxes—not to place the system into sleep mode.

From a threat hunting and malware analysis perspective, the combination ofCryptoAPI usage, registry modification, and internet-related APIs (InternetReadFile, InternetQueryDataAvailable) is a classic ransomware pattern: retrieve data or keys, encrypt local files, and possibly communicate with command-and-control infrastructure.

Professional defenders recognize these API patterns ashigh-confidence malicious indicators, often mapped toMITRE ATT&CK – Impact: Data Encrypted for Impact (T1486). Detecting such behavior early is critical to prevent widespread data loss and operational disruption.

In summary, the script’s API usage clearly indicates thatits execution results in file encryption, makingOption Dthe correct answer.

The correct answer isMonitoring failed AWS console login attempts. The Bash script shown in the exhibit is clearly designed toparse AWS CloudTrail logsand extract specific authentication-related events.

Breaking down the script behavior from a professional cloud security perspective:

gunzip -c *.json.gz indicates the script is processingcompressed CloudTrail log files, which are typically stored in .json.gz format.

jq -c '.Records[]' parses individual CloudTrail records, a common approach when analyzing AWS activity logs.

The filter conditions explicitly check for:

eventSource == "signin.amazonaws.com"

eventName == "ConsoleLogin"

responseElements.ConsoleLogin == "Failure"

These fields are definitive indicators offailed AWS Management Console login attempts. Additionally, the script extracts contextual fields such as:

Event time

Source IP address

Error message

AWS region

Username

MFA usage status

This data is exactly what security teams use to detectcredential abuse, password spraying, brute-force attempts, and compromised IAM accounts. Monitoring failed console logins is a foundational cloud threat hunting activity, especially for identifying early stages of account takeover.

Option B is incorrect because the script does not establish AWS CLI sessions or authenticate to accounts. Option C is incorrect because instance errors would involve services like ec2.amazonaws.com and different event names. Option D is incorrect because the script is analyzing—not archiving—records, and it applies filtering logic rather than storage or lifecycle management.

From a threat hunting and cloud security standpoint, this script supportsidentity-focused detection, which is critical in AWS environments where IAM misuse is one of the most common initial access vectors. It aligns withMITRE ATT&CK – Credential Access and Initial Access, particularly techniques involving valid account abuse.

In summary, the script’s clear purpose is tomonitor failed AWS console login attempts, makingOption Athe correct and professionally validated answer.

The correct answer isObservation of repeated failed logins followed by a successful login from a new location. This scenario represents anIndicator of Attack (IOA)because it reflectsattacker behavior in progress, not confirmed compromise.

IOAs focus onpatterns of malicious intent, such as credential abuse, reconnaissance, or lateral movement, even when no malware or known indicators are present. In this case, the sequence of failed authentication attempts followed by a successful login from an unusual location strongly suggestspassword spraying or credential stuffing, both common initial access techniques.

Options A, B, and D are classicIndicators of Compromise (IOCs). Hashes, domains, and IP addresses are static artifacts that indicate a systemhas already been compromised. These indicators sit low on thePyramid of Painand are easy for attackers to change.

Cisco’sCBRTHD blueprintemphasizes hunting forIOAsbecause they enable:

Earlier detection

Reduced dwell time

Higher attacker cost

Cisco tools such asSecure Network Analytics,Secure Endpoint, and SIEM platforms are designed to correlate behavioral signals like authentication anomalies rather than relying solely on known bad indicators.

Therefore,Option Cis the correct and Cisco-aligned answer.

The correct answers areA. Service and version of the web serverandC. Technology used by the application. The error message shown in the exhibit is a classic example ofverbose error handling, which unintentionally discloses sensitive internal details about the web application stack.

First, the error page explicitly referencesApache Tomcat/6.0.16at the bottom. This directly exposes theweb server/service and its exact version, makingOption Acorrect. From an attacker’s perspective, this is valuable intelligence because it allows them to search forknown vulnerabilities, exploits, or misconfigurationsspecific to that version of Tomcat. Older versions of Tomcat, in particular, have a long history of publicly documented security flaws.

Second, the stack trace references components such as:

org.apache.jasper.compiler.*

.jsp files (e.g., /user/left.jsp)

javax.servlet.http.HttpServlet

These details clearly reveal thetechnology stack used by the application, namelyJava Server Pages (JSP)running onApache Tomcat with Apache Jasper. This confirmsOption Cas correct. Exposing application technology helps attackers tailor attacks such as deserialization exploits, JSP injection attempts, or framework-specific vulnerabilities.

Option B is incorrect because the error message doesnotstate or imply that Apache Jasper is vulnerable to path injection; it merely shows a compilation/runtime error. Option D is incorrect because the error page provides no information about theclient-side browser version—all disclosed details relate to server-side processing.

From a professional security and threat hunting perspective, verbose error messages significantlyincrease attack surface visibility. Best practices dictate that production systems should returngeneric error messagesto users while logging detailed stack traces internally. This scenario reinforces why proper error handling and information disclosure controls are critical defensive measures.

In summary, the penetration test error message exposes:

Theweb server service and version

Theapplication technology stack

Therefore, the correct answers areA and C.

The correct answer isformulating a hypothesis to search for credential misuse without alerts. This activity is the defining characteristic ofthreat hunting.

Threat hunting isproactive and hypothesis-driven, meaning analysts intentionally search for attacker behavior that has not yet triggered alerts. Detection engineering, on the other hand, focuses on building and tuning automated rules that respond to known patterns.

Options A, B, and D all representreactive or preventative security operations. They rely on known indicators or alerts and are foundational but insufficient against stealthy adversaries who abuse valid credentials and native tools.

Cisco’sCBRTHD blueprintexplicitly emphasizes hypothesis-based hunting as a core competency. Hunters ask questions like:

“If credentials were stolen, how would that look in our telemetry?”

“What behavior would indicate lateral movement without malware?”

This approach aligns with detectingIndicators of Attack (IOAs)and operating higher on thePyramid of Pain, forcing adversaries to change tactics instead of infrastructure.

Therefore,Option Cis the correct and Cisco-aligned answer.

The correct answer isSimple. The exhibit shows an EDR query filtering onspecific IPv4 addresses, which are classicIndicators of Compromise (IOCs). Within thePyramid of Painmodel, IP addresses sit at thelowest level, representing the least painful indicators for adversaries to change.

The Pyramid of Pain categorizes detection indicators by how costly they are for attackers to replace:

Simple→ Hashes, IP addresses, domain names

Easy→ Network artifacts (URI patterns, user-agent strings)

Challenging→ Host artifacts (registry keys, file paths, mutexes)

Tough→ Tactics, Techniques, and Procedures (TTPs)

In this scenario, the threat-hunting team is querying EDR telemetry for outbound connections toknown C2 IP addresses. While this is a valid and common detection technique—especially for rapid containment—it provides minimal long-term defensive value. Attackers can easily rotate C2 infrastructure by changing IPs, using cloud hosting, fast-flux DNS, or proxy networks.

Option C (Easy) would apply if the team were hunting fornetwork artifacts, such as suspicious URI paths or protocol misuse. Option B (Challenging) would involvehost-based artifacts, like malware persistence keys or file system changes. Option A (Tough) represents the highest maturity—detectingadversary behavior and techniques, such as beaconing patterns, lateral movement workflows, or credential abuse—none of which are present here.

From a professional threat-hunting standpoint, IP-based detections are best used asshort-term controlsfor blocking known threats or scoping an incident. Mature organizations use them as a starting point, then pivot toward higher-fidelity detections that sit higher on the Pyramid of Pain and impose greater operational cost on attackers.

In summary, querying known C2IP addressescorresponds to theSimplelevel of the Pyramid of Pain, makingOption Dthe correct answer.

The correct answer isExploit public-facing application. The log excerpt in the exhibit clearly shows amalicious HTTP GET requesttargeting aWordPress plugin PHP filewith a craftedSQL injection payload:

UNION ALL SELECT CONCAT(...)

This syntax is a classic indicator ofSQL injection, a well-documented attack technique used to exploit insufficient input validation in web applications. According to the MITRE ATT&CK framework, this behavior maps to theInitial Access tactic (TA0001)and the techniqueExploit Public-Facing Application (T1190). The attacker is directly interacting with a publicly accessible web service and abusing a vulnerability in the application code to gain unauthorized access.

From a threat hunting and forensic standpoint, this is a textbook example of how attackers commonly achieve initial access to web servers. The attacker did not authenticate via remote services (such as SSH or RDP), nor did they rely on user interaction (as in a drive-by compromise). Instead, they sent a specially crafted request to a vulnerable endpoint exposed to the internet. This makes option B incorrect becauseExternal Remote Servicesrequires legitimate service access mechanisms. Option C is also incorrect becauseCommand and Scripting Interpreteris typically usedafterinitial access, once code execution is already achieved. Option D does not apply because there is no evidence of malicious content being delivered to end users.

The forensic team’s actions—isolating the server, cloning the disk, and analyzing logs—are standard post-incident procedures to reconstruct the attack chain. Web server access logs are especially valuable in these cases, as they often reveal malicious payloads, attacker IP addresses, targeted endpoints, and timestamps.

For defenders and threat hunters, this scenario reinforces the importance of monitoring web logs for anomalous query strings, enforcing secure coding practices, conducting regular vulnerability scans, and promptly patching third-party plugins. Public-facing applications remain one of themost exploited initial access vectors, making this technique a critical focus area in modern threat hunting programs.