300-220 CBRTHD: Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity

By Cisco · Question Mode

QuestionQ37

Threat Hunting Techniques

A security team needs to develop a plan to protect companies against lateral-movement attacks. The team has already implemented detection alerts for pass-the-hash and pass-the-ticket techniques.

Which two components must be monitored to hunt for lateral-movement attacks on endpoints?

Choose two
Explanation

Windows Remote Management enables remote management and command execution against another host, making it a lateral-movement channel. Connections to remote administrative shares can enable access to another system and the transfer or execution of content there, so command and tool use targeting remote shares is also important lateral-movement telemetry.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!