300-220 · Question #123
Which step in the threat hunting process involves creating and executing queries to search for indicators of compromise?
The correct answer is A. Data Analysis. Data Analysis (A) is correct because this is the phase where threat hunters actively query datasets - writing and running searches against logs, telemetry, or SIEM data - to surface indicators of compromise (IOCs) like suspicious IPs, file hashes, or anomalous behaviors. Why…
Question
Which step in the threat hunting process involves creating and executing queries to search for indicators of compromise?
Options
- AData Analysis
- BData Collection
- CData Processing
- DData Enrichment
How the community answered
(39 responses)- A92% (36)
- C3% (1)
- D5% (2)
Explanation
Data Analysis (A) is correct because this is the phase where threat hunters actively query datasets - writing and running searches against logs, telemetry, or SIEM data - to surface indicators of compromise (IOCs) like suspicious IPs, file hashes, or anomalous behaviors.
Why the distractors are wrong:
- B. Data Collection is the earlier step of gathering raw data from endpoints, logs, and network feeds - it doesn't involve querying or hunting yet.
- C. Data Processing refers to normalizing, parsing, and transforming raw data into a usable format (e.g., structured logs) - still preparatory work before analysis.
- D. Data Enrichment adds context to existing data (e.g., attaching threat intel or geolocation to an IP), but isn't where you execute the hunting queries themselves.
Memory tip: Think of the flow as a pipeline - Collect → Process → Enrich → Analyze. "Analyze" is the action step where a hunter puts on their detective hat and asks questions of the data by running queries, so it's the one that produces IOC hits.
Topics
Community Discussion
No community discussion yet for this question.