300-220 Exam Questions & Answers

The correct answer is formulating a hypothesis to search for credential misuse without alerts. This activity is the defining characteristic of threat hunting.

Threat hunting is proactive and hypothesis-driven, meaning analysts intentionally search for attacker behavior that has not yet triggered alerts. Detection engineering, on the other hand, focuses on building and tuning automated rules that respond to known patterns.

Options A, B, and D all represent reactive or preventative security operations. They rely on known indicators or alerts and are foundational but insufficient against stealthy adversaries who abuse valid credentials and native tools.

Cisco's CBRTHD blueprint explicitly emphasizes hypothesis-based hunting as a core competency. Hunters ask questions like:

''If credentials were stolen, how would that look in our telemetry?''

''What behavior would indicate lateral movement without malware?''

This approach aligns with detecting Indicators of Attack (IOAs) and operating higher on the Pyramid of Pain, forcing adversaries to change tactics instead of infrastructure.

Therefore, Option C is the correct and Cisco-aligned answer.

The correct answer is Exploit public-facing application. The log excerpt in the exhibit clearly shows a malicious HTTP GET request targeting a WordPress plugin PHP file with a crafted SQL injection payload:

UNION ALL SELECT CONCAT(...)

This syntax is a classic indicator of SQL injection, a well-documented attack technique used to exploit insufficient input validation in web applications. According to the MITRE ATT&CK framework, this behavior maps to the Initial Access tactic (TA0001) and the technique Exploit Public-Facing Application (T1190). The attacker is directly interacting with a publicly accessible web service and abusing a vulnerability in the application code to gain unauthorized access.

From a threat hunting and forensic standpoint, this is a textbook example of how attackers commonly achieve initial access to web servers. The attacker did not authenticate via remote services (such as SSH or RDP), nor did they rely on user interaction (as in a drive-by compromise). Instead, they sent a specially crafted request to a vulnerable endpoint exposed to the internet. This makes option B incorrect because External Remote Services requires legitimate service access mechanisms. Option C is also incorrect because Command and Scripting Interpreter is typically used after initial access, once code execution is already achieved. Option D does not apply because there is no evidence of malicious content being delivered to end users.

The forensic team's actions---isolating the server, cloning the disk, and analyzing logs---are standard post-incident procedures to reconstruct the attack chain. Web server access logs are especially valuable in these cases, as they often reveal malicious payloads, attacker IP addresses, targeted endpoints, and timestamps.

For defenders and threat hunters, this scenario reinforces the importance of monitoring web logs for anomalous query strings, enforcing secure coding practices, conducting regular vulnerability scans, and promptly patching third-party plugins. Public-facing applications remain one of the most exploited initial access vectors, making this technique a critical focus area in modern threat hunting programs.

The correct answer is endpoint process ancestry tracking. Credential harvesting attacks frequently rely on fileless execution and living-off-the-land techniques.

When no files are written to disk, hash-based detection (Option A) is ineffective. Email sandboxing (Option C) and URL filtering (Option D) may detect initial delivery but provide little visibility into post-execution behavior.

Cisco Secure Endpoint provides detailed telemetry on:

Parent-child process relationships

Unexpected process spawning

Abnormal command-line arguments

Memory-resident execution

By analyzing process ancestry, hunters can identify suspicious chains such as:

Office applications spawning scripting engines

Browsers spawning credential-harvesting processes

Legitimate binaries launching unexpected child processes

This capability directly supports MITRE ATT&CK Credential Access and Defense Evasion techniques and is explicitly covered in the CBRTHD exam objectives related to endpoint-based threat hunting.

Thus, Option B is the most accurate and Cisco-aligned answer.

The correct answer is mapping trust relationships between identity systems. Hybrid identity environments introduce complex trust boundaries that attackers routinely exploit.

Modern breaches increasingly involve identity pivoting, where attackers compromise a cloud identity and abuse synchronization, federation, or conditional access misconfigurations to escalate into on-prem Active Directory. These attack paths often do not rely on software vulnerabilities at all.

Option A is too narrow and focuses only on technical exploits. Option C measures severity but does not model movement. Option D analyzes traffic but does not explain privilege escalation pathways.

By mapping trust relationships---such as Azure AD Connect synchronization, service principals, hybrid admin roles, and conditional access exclusions---defenders can identify chained attack paths that enable privilege escalation without exploiting code.

From a threat hunting standpoint, this modeling enables:

Hypothesis-driven hunts

Detection of abnormal role assumptions

Visibility into identity abuse

This approach aligns with attack path modeling, a critical evolution of traditional threat modeling for identity-centric environments. Therefore, option B is correct.

The correct answer is detecting abnormal authentication behavior across VPN and cloud access. This outcome targets behavioral detection, which sits significantly higher on the Pyramid of Pain than static indicators.

Options A and C rely on domains and hashes, which attackers can trivially change. Option D is a response action, not a hunting outcome.

Credential misuse is one of the most common initial access vectors, especially in cloud and remote-access environments. Detecting abnormal authentication behavior---such as:

Impossible travel

Unusual login times

Excessive failed logins

Geographic anomalies

forces attackers to change how they operate, not just what infrastructure they use.

Cisco tools such as:

Secure Network Analytics

Secure Endpoint

Secure Firewall

Identity telemetry via VPN and SSO

enable this higher-fidelity detection approach. This aligns directly with CBRTHD blueprint objectives focused on identity-based threat hunting.

Therefore, Option B is correct.