Security Operations
Targeted SY0-701 practice for this exam objective, with an explanation for every answer option.
- Certification
- SY0-701
- Domain
- Security Operations
- Questions
- 10
Practice SY0-701 Security Operations questions with exam-style scenarios, detailed explanations, and option-by-option rationale for this domain.
Example question from this objective
Each option is explained, so the reasoning behind the distractors is part of the answer.
A SOC under Zero Trust receives threat intelligence on a novel APT lateral movement technique that uses a specific sequence of legitimate admin tools and may evade signature-based EDR alerts. The SOC lead wants a proactive search for early indicators of this TTP. Which threat hunting technique is MOST appropriate?
- Hypothesis-driven hunting
- IOC-driven hunting
- Anomaly-driven hunting
- Statistical anomaly hunting
Hypothesis-driven hunting — Hypothesis-driven hunting starts with a testable assumption based on intelligence, such as expecting a particular sequence of admin-tool use and related activity. It is the best fit for proactively searching for a known TTP in logs, flows, and endpoint data.
IOC-driven hunting — IOC-driven hunting uses known hashes, IPs, domains, or similar indicators. The scenario focuses on a new lateral movement technique and specific TTPs, so there may be no stable IOC set to search for.
Anomaly-driven hunting — Anomaly-driven hunting looks for unusual behavior against a baseline. Here, the SOC already has threat intelligence describing a specific technique, so the better approach is to test a targeted hypothesis rather than wait for an anomaly.
Statistical anomaly hunting — Statistical anomaly hunting uses models to find outliers in large datasets. It can help find unknown behavior, but the scenario already provides detailed intelligence about the technique, making hypothesis-driven hunting more precise.