Knowledge check

200 XP

Choose the best response for each of the questions below.

Check your knowledge

Which of the following best describes a good Hypothesis?

is Time-bound

focuses on known Indicators

focuses on all current threats

Threat Hunting is considered which of the following?

Retroactive.

Reactive.

Proactive.

"We want to check which accounts have run cmd.exe." Why is this hypothesis poor?

Cmd.exe isn't a program.

Accounts aren't associated with the running of cmd.exe

The scope is too broad.

You must answer all questions before checking your work.

Having an issue? We can help!

For issues related to this module, explore existing questions using the #azure training tag or Ask a question on Microsoft Q&A.
For issues related to Certifications and Exams, post on Certifications Support Forums or visit our Credentials Help.