nerdexam
Cisco

300-220 · Question #101

In the context of the threat hunting process, what does the term "pivot" mean?

The correct answer is C. To move quickly from one hypothesis to another. Pivoting in threat hunting means rapidly shifting focus from one hypothesis to another as new evidence emerges or a lead proves unproductive. When hunters investigate a potential threat and the data doesn't support their current theory, they "pivot" - redirecting their…

Threat Hunting Processes

Question

In the context of the threat hunting process, what does the term "pivot" mean?

Options

  • ATo rotate data points in a visualization
  • BTo backtrack and analyze previous data
  • CTo move quickly from one hypothesis to another
  • DTo confirm a suspected threat

How the community answered

(39 responses)
  • A
    5% (2)
  • B
    3% (1)
  • C
    90% (35)
  • D
    3% (1)

Explanation

Pivoting in threat hunting means rapidly shifting focus from one hypothesis to another as new evidence emerges or a lead proves unproductive. When hunters investigate a potential threat and the data doesn't support their current theory, they "pivot" - redirecting their investigation toward a new angle, indicator, or attack vector rather than getting stuck.

  • A is wrong because rotating data in visualizations is a data analysis technique (like pivot tables), not a threat hunting process term - the word is borrowed in a different context here.
  • B is wrong because backtracking to previous data describes retrospective analysis, not the act of changing investigative direction.
  • D is wrong because confirming a threat is the goal of hunting, not what pivoting means - you might pivot before reaching confirmation.

Memory tip: Think of a basketball player pivoting - one foot stays planted (your core methodology) while you spin to face a new direction (new hypothesis). In threat hunting, your discipline stays constant while your focus rapidly reorients.

Topics

#pivot#hypothesis testing#threat hunting#investigation workflow

Community Discussion

No community discussion yet for this question.

Full 300-220 Practice