Important Cisco 300-220 CBRTHD Exam Questions

Answer: A

Explanation:

The correct next action is to submit the file for sandboxing. In professional security operations and threat hunting workflows, sandboxing is the most appropriate step when a file originates from an untrusted source and hash-based reputation checks return an unknown result. An unknown hash means the file has not yet been classified as benign or malicious by threat intelligence databases, which is common with newly created malware or targeted attacks.

Sandboxing allows the security team to perform dynamic analysis by executing the file in an isolated, controlled environment. This process observes runtime behaviors such as process creation, registry modification, network communications, command-and-control callbacks, file system changes, and exploit attempts. These behaviors provide high-fidelity indicators that static analysis or hash lookups cannot reveal.

Option B, reviewing the directory path, is useful for contextual awareness but does not determine whether the file is malicious. Option C, running a full malware scan, is premature; modern malware often evades signature-based scans, especially when the file is previously unknown. Option D, investigating the reputation of the website, is a supporting activity but does not assess the actual behavior or payload of the downloaded file.

From a threat hunting and incident response standpoint, sandboxing bridges the gap between detection and confirmation. If the sandbox analysis confirms malicious behavior, the team can escalate to containment actions such as isolating the endpoint, blocking hashes and domains, and performing scope analysis to identify other affected systems. Additionally, sandbox results can be used to create new SIEM detections and EDR behavioral rules, strengthening future defenses.

This approach aligns with professional best practices: unknown file + untrusted source = dynamic analysis first. It ensures accurate classification while minimizing unnecessary disruption to the user or environment.

Answer: D

Explanation:

The correct answer is Simple. The exhibit shows an EDR query filtering on specific IPv4 addresses, which are classic Indicators of Compromise (IOCs). Within the Pyramid of Pain model, IP addresses sit at the lowest level, representing the least painful indicators for adversaries to change.

The Pyramid of Pain categorizes detection indicators by how costly they are for attackers to replace:

Simple Hashes, IP addresses, domain names

Easy Network artifacts (URI patterns, user-agent strings)

Challenging Host artifacts (registry keys, file paths, mutexes)

Tough Tactics, Techniques, and Procedures (TTPs)

In this scenario, the threat-hunting team is querying EDR telemetry for outbound connections to known C2 IP addresses. While this is a valid and common detection technique---especially for rapid containment---it provides minimal long-term defensive value. Attackers can easily rotate C2 infrastructure by changing IPs, using cloud hosting, fast-flux DNS, or proxy networks.

Option C (Easy) would apply if the team were hunting for network artifacts, such as suspicious URI paths or protocol misuse. Option B (Challenging) would involve host-based artifacts, like malware persistence keys or file system changes. Option A (Tough) represents the highest maturity---detecting adversary behavior and techniques, such as beaconing patterns, lateral movement workflows, or credential abuse---none of which are present here.

From a professional threat-hunting standpoint, IP-based detections are best used as short-term controls for blocking known threats or scoping an incident. Mature organizations use them as a starting point, then pivot toward higher-fidelity detections that sit higher on the Pyramid of Pain and impose greater operational cost on attackers.

In summary, querying known C2 IP addresses corresponds to the Simple level of the Pyramid of Pain, making Option D the correct answer.

Answer: B

Explanation:

The correct answer is B. Using 'SecurityScan/2.5' to access all /admin endpoints. This log entry most clearly aligns with an authorized security assessment activity designed to test weaknesses previously exploited during a breach.

Authorized security assessments---such as penetration tests or red team exercises---are typically controlled, scoped, and intentional. They focus on validating security controls by probing sensitive areas (like administrative interfaces) while avoiding destructive actions. The user-agent string 'SecurityScan/2.5' strongly suggests a purpose-built security scanning tool, which is commonly used by internal security teams or third-party assessors during sanctioned testing.

Option A is incorrect because performing login attempts at scale using leaked credentials would constitute real-world malicious behavior unless explicitly approved and tightly controlled. Even in authorized tests, credential stuffing with known leaked credentials is highly sensitive and would be explicitly documented; the wording here implies adversary behavior rather than assessment activity.

Option C is clearly malicious and inappropriate for an authorized assessment. Executing a shutdown command is a destructive action and would violate standard rules of engagement for professional security testing. Such activity would be classified as adversarial exploitation, not a controlled delivery method.

Option D represents benign reconnaissance. A generic web crawler gathering public-facing information is typically associated with search engines or basic reconnaissance and does not directly test weaknesses related to a prior breach. While reconnaissance is part of assessments, it is not a strong indicator of a targeted, authorized delivery method.

From a threat hunting and SOC perspective, recognizing authorized assessment activity is critical to avoid misclassifying tests as incidents. Indicators include identifiable scanner user agents, predictable request patterns, limited scope targeting (such as /admin paths), and non-destructive behavior. This scenario reinforces an important operational lesson: context, intent, and tooling matter. Among the options, SecurityScan/2.5 targeting administrative endpoints best reflects a legitimate, authorized security assessment delivery method.

Answer: C

Explanation:

The correct answer is it reveals consistent attacker tradecraft across incidents. Attribution relies on behavioral consistency, not on malware samples or exploits.

Avoiding malware and abusing legitimate tools (living-off-the-land techniques) reflects a deliberate operational strategy. These behaviors tend to remain consistent across campaigns and are frequently documented in threat intelligence profiles.

Options A and D are incorrect because no exploit or ransomware is involved. Option B is incorrect; living-off-the-land techniques are modern, not outdated.

Cisco-aligned threat hunting emphasizes MITRE ATT&CK mapping and behavioral analysis to support attribution efforts. This approach is far more reliable than artifact-based attribution.

Thus, Option C is the correct answer.

Answer: C

Explanation:

The correct answer is earlier detection of attacks before data exfiltration. This outcome directly translates to reduced business impact, which is the ultimate goal of threat hunting.

Alert volume (Option A) and false-positive reduction (Option B) measure operational efficiency, not security effectiveness. Option D measures spending, not outcomes.

Early detection:

Reduces dwell time

Prevents data loss

Limits operational disruption

Increases attacker cost

Cisco's CBRTHD blueprint emphasizes outcome-driven security metrics, with early detection being one of the strongest indicators of threat hunting maturity.

Therefore, Option C is the correct and executive-level answer.