Conducting Threat Hunting and Defending using Cisco Technologies for CyberOps 300-220 Exam Questions

The correct answer is authentication and remote execution logs . Lateral movement using legitimate tools relies heavily on credential use and remote management protocols , not malware execution.

Attackers commonly use:

RDP

SMB administrative shares

WinRM

WMI

SSH

These techniques generate authentication events, remote logons, and service execution logs rather than malware alerts. Antivirus tools are ineffective here because no malicious binaries are involved.

Option A is ineffective against living-off-the-land attacks. Option B is unrelated to lateral movement. Option D may show some activity but lacks the necessary depth to identify privilege misuse or session hopping.

Authentication telemetry enables hunters to detect anomalies such as:

Logons between non-associated systems

Sudden administrative access

Credential reuse across hosts

Abnormal session timing and frequency

This data is foundational for credential-based attack detection , which remains one of the most common breach paths today. It also aligns with MITRE ATT & CK Lateral Movement and Credential Access tactics .

Thus, option C is the correct answer.

The correct answer is Attack trees . Attack trees are uniquely suited for modeling multi-step adversary behavior , which is essential when analyzing complex attack chains such as account takeover followed by data exfiltration.

Attack trees begin with a high-level attacker goal (for example, “Exfiltrate customer data”) and then break that goal into multiple branches representing different paths an attacker could take. These paths can include credential compromise, API abuse, privilege escalation, lateral movement, and persistence. This structure mirrors how real adversaries think and operate.

Option A (STRIDE) is useful for identifying broad threat categories—such as spoofing, tampering, or information disclosure—but it does not naturally capture sequential attack paths . Option B (CVSS) focuses on vulnerability severity scoring, not adversary behavior. Option D (DREAD) assesses risk impact but does not visualize how attacks unfold across systems.

For threat hunters and defenders, attack trees provide a shared mental model between architects, SOC teams, and red teams. They directly inform detection engineering by highlighting critical choke points where attacker behavior must occur, such as token abuse, API enumeration, or anomalous role assumption in cloud environments.

In modern cloud security, where breaches often involve multiple low-severity issues chained together , attack trees offer far greater strategic value than component-by-component analysis. They also align closely with MITRE ATT & CK mapping , enabling defenders to translate threat models into actionable hunts.

Thus, option C is the most appropriate and professionally validated answer.

The correct answer is formulating a hypothesis to search for credential misuse without alerts . This activity is the defining characteristic of threat hunting .

Threat hunting is proactive and hypothesis-driven , meaning analysts intentionally search for attacker behavior that has not yet triggered alerts. Detection engineering, on the other hand, focuses on building and tuning automated rules that respond to known patterns.

Options A, B, and D all represent reactive or preventative security operations . They rely on known indicators or alerts and are foundational but insufficient against stealthy adversaries who abuse valid credentials and native tools.

Cisco’s CBRTHD blueprint explicitly emphasizes hypothesis-based hunting as a core competency. Hunters ask questions like:

“If credentials were stolen, how would that look in our telemetry?”

“What behavior would indicate lateral movement without malware?”

This approach aligns with detecting Indicators of Attack (IOAs) and operating higher on the Pyramid of Pain , forcing adversaries to change tactics instead of infrastructure.

Therefore, Option C is the correct and Cisco-aligned answer.

The correct answer is standardizing hunt documentation and hypotheses . Mature threat hunting programs move beyond ad-hoc, intuition-driven efforts.

Standardization enables:

Knowledge sharing

Consistent methodology

Repeatable hunts

Easier onboarding of new analysts

Option A and B support operations but do not improve hunting maturity. Option D is unrealistic and risky.

By documenting hypotheses, data sources, queries, findings, and outcomes, organizations institutionalize knowledge and continuously improve detection capabilities.

This is a defining characteristic of high-maturity threat hunting programs .

Therefore, option C is correct.

The correct answers are Use of Windows Remote Management (C) and Use of tools and commands to connect to remote shares (E) . Both are core mechanisms attackers leverage for lateral movement after gaining valid credentials through techniques such as pass-the-hash or pass-the-ticket.

Windows Remote Management (WinRM) is a legitimate administrative service used for remote command execution and system management. However, attackers frequently abuse WinRM to move laterally by executing commands on remote endpoints using stolen credentials. From a threat hunting perspective, abnormal WinRM usage—such as execution outside normal administrative hours, from unusual source hosts, or by non-administrative user accounts—is a strong indicator of lateral movement activity.

Similarly, the use of tools and commands to connect to remote shares (such as net use, wmic, SMB-based access, or mounting administrative shares like C$) is a classic lateral movement technique. Attackers use remote shares to transfer tools, stage payloads, and execute malware across systems. Monitoring these activities at the endpoint level helps identify suspicious authentication attempts, unexpected share access, and abnormal file transfers.

Option A (runas) relates more to privilege escalation than lateral movement. Option B is specific to Linux privilege persistence and is not relevant to endpoint lateral movement hunting in this context. Option D (scheduled task creation) is primarily associated with persistence rather than movement between systems.

By monitoring WinRM activity and remote share usage, security teams gain visibility into credential-based movement , which remains one of the most common and dangerous attacker behaviors in enterprise environments. Effective lateral movement hunting focuses on how credentials are used , not just how they are stolen.