Cisco Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity 300-220 CBRTHD 300-220 Question # 16 Topic 2 Discussion
300-220 Exam Topic 2 Question 16 Discussion:
Question #: 16
Topic #: 2
A SOC repeatedly discovers similar attacker behaviors during separate hunts, indicating recurring detection gaps. What process change MOST effectively prevents rediscovery of the same threats?
A.
Increasing analyst staffing
B.
Automating hunt execution
C.
Converting hunt findings into permanent detections
The correct answer isconverting hunt findings into permanent detections. Threat hunting is only effective when discoveries areoperationalized.
Without converting findings into SIEM, EDR, or NDR detections, organizations repeatedly identify the same attacker behaviors, wasting time and resources. Options A, B, and D improve capacity but do not eliminate blind spots.
Mature threat hunting programs ensure that:
Hunts produce detection rules
Alerts are tuned and validated
Knowledge is institutionalized
This is a defining trait ofhigh-maturity security organizationsand directly improves resilience. Therefore, optionCis correct.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit