Free Cisco 300-220 Practice Test Questions

Question 1

What is the purpose of threat intelligence in threat hunting?

A : To analyze network traffic and identify potential threats

B : To identify and understand threat actors and their tactics

C : To encrypt sensitive data and protect it from unauthorized access

D : To assess the overall risk posture of an organization-s network

Answer: B

Question 2

What is the main goal of threat hunting?

A : To detet and respond to known threats

B : To investigate and stop insider threats

C : To proactively identify and mitigate unknown threats

D : To prevent all cyber attacks

Answer: C

Question 3

A mature SOC notices that several incidents over the past year involved attackers abusing legitimate administrative tools rather than deploying custom malware. Leadership asks the threat hunting team to improve detection coverage in a way that increases attacker cost rather than relying on easily replaceable indicators. Which detection strategy best aligns with this objective?

A : Blocking known malicious file hashes at the endpoint

B : Correlating attacker behavior across multiple MITRE ATT&CK techniques

C : Ingesting additional commercial threat intelligence feeds

D : Creating alerts for newly registered domains

Answer: B

Question 4

Refer to the exhibit.A security team detects a spike in traffic from the company web server. After further investigation, the team discovered that multiple connections have been established from the server to different IP addresses, but the web server logs contain both expected traffic and DDoS traffic. Which attribute must the team use to further filter the logs?

A : connection status

B : destination port

C : IP address of the web server

D : protocol

Answer: A

Question 5

A mature SOC notices that several incidents over the past year involved attackers abusing legitimate administrative tools rather than deploying custom malware. Leadership asks the threat hunting team to improve detection coverage in a way that increases attacker cost rather than relying on easily replaceable indicators. Which detection strategy best aligns with this objective?

A : Blocking known malicious file hashes at the endpoint

B : Correlating attacker behavior across multiple MITRE ATT&CK techniques

C : Ingesting additional commercial threat intelligence feeds

D : Creating alerts for newly registered domains

Answer: B

Free Cisco 300-220 Exam Practice Questions 2026