Cisco Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity Exam Practice Test
The Cisco Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity Exam (300-220 CBRTHD) practice page focuses on threat-hunting investigation and defensive response. Its question bank uses scenarios about interpreting identity, cloud, endpoint, DNS, and network evidence; checking event timelines; and evaluating whether available telemetry can expose suspicious activity.
Exam overview
About the Cisco Conducting Threat Hunting and Defending using Cisco Technolo… Exam
Effective hunting connects separate events into a defensible account of activity. Practice interpreting authentication sequences, cloud audit records, process ancestry, persistence indicators, DNS answers, and exposure evidence such as service reachability. Correlating endpoint and network timestamps also requires checking clock alignment and event context before drawing conclusions. When suspicious behavior appears, establish what the evidence supports, identify missing visibility, and select a next investigative step that can distinguish benign activity from intrusion. Response decisions should weigh containment against preservation of volatile or otherwise useful evidence. These skills reflect operational tasks such as validating a hypothesis against telemetry, documenting uncertainty, and choosing a proportionate defensive action rather than treating one alert as proof of compromise.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
An organization suspects that a compromised account was used to access cloud services. Which evidence is most directly useful for establishing the account's activity?
Show answer
Correct answer: AAuthentication and cloud audit logs can show when and how an account was used, including sign-in context and actions performed. These records support a timeline and help assess the scope of possible misuse.
A security analyst needs to determine whether a suspicious process persisted across a reboot. Which evidence is most directly relevant?
Show answer
Correct answer: APersistence mechanisms commonly configure software to run at startup or on a schedule. Reviewing relevant startup locations and comparing them with approved software can help identify how a process may survive reboot.
A network sensor reports a suspicious connection, but the associated timestamp appears inconsistent with endpoint logs. What should the investigator check first?
Show answer
Correct answer: AClock drift, time-zone differences, and timestamp-format mismatches can make related events appear out of order. Verifying time settings helps build an accurate cross-source timeline before drawing conclusions.
A security team observes a spike in failed logins followed by a successful login to one account from an unfamiliar location. What is the best initial interpretation?
Show answer
Correct answer: AThe sequence may indicate credential guessing or other suspicious activity, but location and login failures alone do not prove compromise. Correlating authentication details with subsequent actions and known user context supports a more reliable assessment.
An investigation finds a suspicious domain in DNS logs. Which DNS record type would most directly show the IPv4 address returned for that domain?
Show answer
Correct answer: AAn A record maps a domain name to an IPv4 address. MX records identify mail exchangers, TXT records carry text data, and NS records identify name servers.
An analyst needs to investigate whether an exposed service was reachable from the public internet during a specific period. Which evidence is most directly relevant?
Show answer
Correct answer: AHistorical firewall or cloud access-control configurations can show whether inbound paths to the service were permitted during the period of interest. The analyst should also validate the relevant address, port, and time range.
Which telemetry is most useful for determining whether a process launched an unexpected child process on an endpoint?
Show answer
Correct answer: AProcess-creation telemetry, especially parent-child relationships and command-line details, helps analysts identify suspicious execution chains and investigate how a process started another process.
How to use this practice test
The free US Practice Tests practice bank contains 50 published questions. Each session presents up to 20 random questions, with results shown after the session. Use the scenarios to test evidence selection, event correlation, investigation sequencing, and response judgment; revisit missed items by identifying which data source or inference the scenario calls for.
Preparation tips
- For account-compromise scenarios, distinguish identity-provider sign-in records and cloud audit events from endpoint evidence; note the user, time, source location, and resource accessed.
- Practice building a process timeline from endpoint telemetry, including parent-child relationships, command-line arguments, encoded script content, and persistence across reboot.
- When timestamps conflict across sensors, check time zones, clock synchronization, collection delay, and event semantics before correlating activity.
- For DNS and exposure questions, connect the evidence to the claim: an A record maps a name to an IPv4 address, while reachability requires records showing whether the service was externally accessible during the relevant period.
- For suspected command-and-control activity, identify what must be contained and what evidence could be lost; explain how your response preserves useful forensic context.