300-220 Sample Questions

300-220 Sample Questions & Answers

Free Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity practice questions with worked answers and explanations. See how the ExamJungle simulator prepares you — then jump into the full test.

Launch the full 300-220 simulator →

Showing 6 of 12 free samples.

  1. Question 1Intermediate

    Threat Hunting Fundamentals · Describe threats and how to model them with standards such as MITRE ATT&CK, MITRE CAPEC, TaHiTI, and PASTA

    Following the publication of a sector-specific threat advisory detailing novel credential access behaviors, a threat hunter at a financial clearinghouse initiates a formal investigation under the TaHiTI methodology. The hunter has already captured the advisory trigger in a hunting investigation abstract, selected the abstract from the hunting backlog, enriched it using the Diamond Model, and formulated a testable hypothesis with defined data sources. When the hunter queries the endpoint and SIEM data during the Execute step, the validation result is inconclusive because command-line auditing was disabled on a subset of domain controllers. According to the TaHiTI workflow, what is the immediate next action within Phase II?

    Show answer & explanation

    Correct answer: A

    In Phase II (Hunt) of the TaHiTI methodology, hunters move between two core steps: Define / refine and Execute. The final activity of Execute is hypothesis validation, which yields one of three outcomes: proven, disproven, or inconclusive. When omissions in data sources, scope, or techniques are discovered during execution—or when further iterations are needed—the methodology specifies cycling back to Define / refine to adjust the investigation parameters or updating the hunting backlog with follow-up abstracts before moving to Phase III (Finalize).

    flowchart LR subgraph P1["Phase I: Initiate"] S1[Trigger] --> S2[Investigation Abstract] S2 --> S3[Hunting Backlog] end subgraph P2["Phase II: Hunt"] S4[Define / Refine] --> S5[Execute & Validate Hypothesis] S5 -->|Iterate / Refine| S4 end subgraph P3["Phase III: Finalize"] S6[Document Findings & Handover] end S3 --> S4 S5 -->|Update Backlog| S3 S5 -->|Proven / Disproven / Concluded| S6
  2. Question 2IntermediateSelect 2

    Threat Hunting Fundamentals · Describe threats and how to model them with standards such as MITRE ATT&CK, MITRE CAPEC, TaHiTI, and PASTA

    When establishing a comprehensive threat modeling and hunting framework for a cloud-hosted enterprise platform, a security architect evaluates MITRE ATT&CK, MITRE CAPEC, TaHiTI, and PASTA. Which TWO statements accurately characterize how these standards model threats and guide defensive operations? (Select TWO)

    Show answer & explanation

    Correct answers: D, E

    MITRE CAPEC (Common Attack Pattern Enumeration and Classification) catalogs common attack patterns to help analysts and architects understand how adversaries exploit weaknesses in software applications and cyber-enabled capabilities. TaHiTI (Targeted Hunting integrating Threat Intelligence) structures threat hunting into three phases (Initiate, Hunt, Finalize) and uses the four features of the Diamond Model (actors, methods/capabilities, infrastructure, victims) to enrich TTP matches.

    TaHiTI is a structured, intelligence-driven threat hunting methodology consisting of three phases (Initiate, Hunt, Finalize) and six steps, incorporating the Diamond Model (actors, methods/capabilities, infrastructure, victims) when enriching TTP matches. By contrast, MITRE D3FEND (not PASTA) is MITRE's knowledge base of defensive countermeasures, MITRE ATT&CK focuses on adversary tactics and techniques rather than CVSS software scoring, and TaHiTI focuses on the top three layers of the Pyramid of Pain rather than the bottom three.

  3. Question 3Beginner

    Threat Hunting Fundamentals · Describe threats and how to model them with standards such as MITRE ATT&CK, MITRE CAPEC, TaHiTI, and PASTA

    True or False: In the MITRE ATT&CK framework, tactics represent the adversary's tactical objective—the "why" behind an action, such as Initial Access (TA0001) or Command and Control (TA0011)—while the ATT&CK Navigator tool can be used to visualize and link attack techniques to specific APT groups.

    Show answer & explanation

    Correct answer: A

    In MITRE ATT&CK, tactics represent the "why" of an ATT&CK technique—the adversary's tactical goal or contextual reason for performing an action, identified by codes such as TA0001 (Initial Access) and TA0011 (Command and Control). Techniques represent "how" an adversary achieves that tactical goal, and the MITRE ATT&CK Navigator tool allows analysts and hunters to map, compare, and link attack techniques to known APT groups.

  4. Question 4Beginner

    Threat Modeling Techniques · Describe the uses of structured and unstructured threat hunting

    To reduce the breach detection gap across a newly acquired subsidiary's network, a senior analyst compares structured and unstructured threat hunting approaches. The subsidiary lacks historical threat intelligence profiles for its industry vertical, so the analyst begins sifting through available DNS and HTTP proxy telemetry to uncover statistical outliers and anomalies without starting from a predefined hypothesis. Which approach is the analyst employing?

    Show answer & explanation

    Correct answer: A

    Unstructured threat hunting is a data-driven approach in which an analyst sifts through available data sources searching for anomalies without starting from a predefined hypothesis or following a set path. In contrast, structured threat hunting is hypothesis-based: a trigger initiates a hunting investigation abstract, a testable hypothesis is formulated first, and the hunt is scoped and executed toward a specific goal.

  5. Question 5Intermediate

    Threat Modeling Techniques · Describe the uses of structured and unstructured threat hunting

    Before executing a structured threat hunt focused on lateral movement across an enterprise Active Directory forest, a hunt team lead reviews the organization's MaGMa use case management repository alongside the JIRA hunting backlog. Why is consulting a use case management framework like MaGMa essential when scoping a structured hunt during the define / refine activity?

    Show answer & explanation

    Correct answer: B

    Threat hunting aims to reduce the breach detection gap by uncovering threats that evade existing controls and introducing new or enhanced detection mechanisms. Consulting a use case management framework such as MaGMa provides clear visibility into what the SOC's automated monitoring rules already detect, ensuring hunters focus their hypotheses on uncovered blind spots rather than duplicating existing detections.

  6. Question 6Advanced

    Threat Modeling Techniques · Determine the priority level of attacks based on the MITRE CAPEC model

    An application security strategist is prioritizing threat mitigation efforts for an online banking portal using the MITRE CAPEC model. During threat modeling, the strategist reviews three related CAPEC entries mapped under Mechanism of Attack 1000 > Abuse Existing Functionality 210:

    1. CAPEC-212 (Functionality Misuse): an abstract characterization of an attack methodology devoid of specific technology or implementation details.
    2. A child pattern focusing on a specific methodology that forms a single component of an executed attack against web session tokens.
    3. A low-level pattern targeting the portal's XML parser (CAPEC-229 XML Attribute Blowup) that chains multiple components into a complete execution flow against that technology.

    How should the strategist classify these three patterns in the CAPEC hierarchy and prioritize immediate technical countermeasures on the production web servers?

    Show answer & explanation

    Correct answer: B

    MITRE CAPEC classifies attack patterns across three hierarchical levels of abstraction: Meta Attack Pattern, Standard Attack Pattern, and Detailed Attack Pattern. A Meta Attack Pattern (such as CAPEC-212 Functionality Misuse) is an abstract characterization without specific technology or implementation details, suited for high-level architecture and design threat modeling. A Standard Attack Pattern specializes a Meta pattern into a specific methodology forming a single component of an attack. A Detailed Attack Pattern provides low-level specifics targeting a particular technology, describes a complete execution flow, and requires specific technical protection mechanisms to mitigate on production systems.

    graph TD Cat["Category: Abuse Existing Functionality (210)"] --> Meta["Meta Attack Pattern (e.g., CAPEC-212 Functionality Misuse) Abstract methodology; no technology specifics"] Meta --> Std["Standard Attack Pattern Specific methodology; single attack component"] Std --> Det["Detailed Attack Pattern (e.g., CAPEC-229) Low-level technology specifics; complete execution flow"]

Ready for the real thing?

The full 300-220 simulator has every exam-style question, timed mode, and instant scoring.

Go to the 300-220 simulator →