Cisco Updated 300-220 Exam Questions and Answers by zaynab

The correct answer isauthentication and remote execution logs. Lateral movement using legitimate tools relies heavily oncredential use and remote management protocols, not malware execution.

Attackers commonly use:

RDP

SMB administrative shares

WinRM

WMI

SSH

These techniques generateauthentication events, remote logons, and service execution logsrather than malware alerts. Antivirus tools are ineffective here because no malicious binaries are involved.

Option A is ineffective against living-off-the-land attacks. Option B is unrelated to lateral movement. Option D may show some activity but lacks the necessary depth to identify privilege misuse or session hopping.

Authentication telemetry enables hunters to detect anomalies such as:

Logons between non-associated systems

Sudden administrative access

Credential reuse across hosts

Abnormal session timing and frequency

This data is foundational forcredential-based attack detection, which remains one of the most common breach paths today. It also aligns withMITRE ATT&CK Lateral Movement and Credential Access tactics.

Thus, optionCis the correct answer.

The correct answer isC. Host 10.201.3.99 is attempting to contact the C2 server to retrieve the payload.

Cisco Secure Network Analytics (Stealthwatch) detectsCommand-and-Control (C2)activity by analyzingnetwork behavior, not by relying solely on known malicious indicators. In the exhibit, the critical investigative clue is theHTTP payload containing a suspicious external URL, which strongly suggests outbound communication from an internal host to an external command-and-control infrastructure.

The internal IP address10.201.3.99belongs to a workstation group (“Desktops”), indicating it is an internal endpoint, not a C2 server. This immediately rules out option B. Instead, the endpoint is acting as acompromised host (zombie)attempting to reach a remote server controlled by an attacker. This outbound beaconing behavior is a classic hallmark of C2 communication.

Option A is incorrect because packet count alone does not confirm C2 activity. C2 traffic is oftenlow-and-slow, intentionally designed to blend in with normal traffic patterns. Option D is also incorrect because the payload does not describe the zombie endpoint; rather, it shows aremote URL, which is likely part of malware staging or command retrieval.

From a threat hunting and SOC perspective, the most valuable information isdirectionality and intent:

Internal host → external suspicious domain

HTTP-based communication over an unusual port

Low data volume consistent with beaconing or payload retrieval

This aligns withMITRE ATT&CK – Command and Control (TA0011)techniques such asApplication Layer Protocols (T1071). Identifying which internal host is reaching out—and why—is essential for containment, endpoint isolation, and scope expansion.

Professionally, this insight enables the analyst to:

Quarantine host 10.201.3.99

Pivot to EDR telemetry on that endpoint

Block the external domain or IP

Hunt for similar beaconing patterns across the environment

In summary, the investigation is aided most by understanding thatan internal host is actively communicating with a C2 server, makingOption Cthe correct and operationally meaningful answer.

The correct answer isUnauthorized penetration test. Based on the scenario provided, there is no indication that the observed activity was planned, approved, or coordinated by the organization. Instead, the evidence points tomalicious, unauthorized accessusing a valid user account, followed by destructive actions on the file server.

The exhibit showsmultiple file deletions and modificationsoccurring within a very short time window after asuccessful remote sign-in. From a professional SOC and threat hunting perspective, this sequence strongly suggestsaccount compromisefollowed byintentional malicious activity, such as data destruction, ransomware staging, or anti-forensics behavior. Intrusion Prevention System alerts further reinforce that the activity violated security policies, which would not be the case during a sanctioned test.

Option A (White box penetration test) and Option D (Black box penetration test) both describetesting methodologies, not threat types. White box testing is conducted with full internal knowledge and explicit authorization, while black box testing is performed with limited knowledge but still under a formal, approved engagement. In both cases, SOC teams are typically informed ahead of time to prevent unnecessary incident escalation.

Option B (Authorized penetration test) is also incorrect because authorized tests are documented, scoped, and approved by management. They do not involve real user account compromise without prior notification, nor do they trigger IPS alerts treated as genuine incidents.

In contrast,unauthorized penetration testingrefers to real-world attacker behavior where an adversary attempts to compromise systems without permission. Even if the attacker’s techniques resemble penetration testing tools or methods, the lack of authorization makes it a true security incident.

From a threat hunting and incident response standpoint, this classification is critical. Treating unauthorized activity as a live threat ensures proper containment actions, such as account disabling, credential resets, forensic preservation, and scope expansion. Misclassifying such activity as a test could lead to delayed response and increased damage.

In short,authorization—not technique—determines intent. Since no authorization exists in this scenario, the activity represents anunauthorized penetration attempt, making optionCthe correct answer.

The correct answer isdocumenting findings and updating detection logic. Threat hunting delivers long-term value only when discoveries are operationalized.

Options A and B are necessary incident response actions but do not improve future detection. Option D delays remediation and risks further damage.

Within theCBRTHD threat hunting lifecycle, confirmed malicious activity should result in:

Detailed documentation of attacker techniques

Identification of detection gaps

Creation or refinement of SIEM, EDR, or NDR rules

This process ensures that similar behavior will be detected automatically in the future, reducing reliance on manual hunts. It also increases organizational maturity by institutionalizing knowledge.

Cisco emphasizes this feedback loop as a core principle of effective threat hunting. Without it, SOC teams repeatedly rediscover the same threats.

Thus,Option Cis the correct and professionally validated answer.