Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

300-220 Conducting Threat Hunting and Defending using Cisco Technologies for CyberOps

  • Cisco
  • 6 free sample questions

About this exam

300-220 is the Cisco exam Conducting Threat Hunting and Defending using Cisco Technologies for CyberOps. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
300-220
Vendor
Cisco
Practice questions
Not available yet
Free sample questions
6
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for 300-220.

Question 1

A threat hunter is performing a structured hunt using Cisco Secure Endpoint (AMP) telemetry to identify credential harvesting activity. Which data source is MOST critical during the data collection and processing phase of the hunt?

  1. Option A:

    File reputation scores from Talos

  2. Option B:

    Endpoint process execution and memory access events

  3. Option C:

    Threat intelligence reports from external vendors

  4. Option D:

    User-reported suspicious activity

Show answer and explanation

Correct answer: B

The correct answer is endpoint process execution and memory access events . During the data collection and processing phase , the goal is to gather high-fidelity telemetry that supports hypothesis validation.


Credential harvesting often occurs without dropping malware and instead relies on:


Memory scraping


LSASS access


Credential dumping tools


In-memory execution


Cisco Secure Endpoint provides deep visibility into:


Process creation and parent-child relationships


Memory access attempts


Privilege abuse


Fileless execution


Option A provides enrichment but not raw behavioral evidence. Option C supports context but does not replace endpoint telemetry. Option D is reactive and unreliable for structured hunts.


Within the CBRTHD threat hunting lifecycle , this phase emphasizes evidence over indicators . Without endpoint execution and memory telemetry, hunters cannot reliably confirm credential access techniques.


This aligns with MITRE ATT & CK Credential Access tactics and Cisco’s emphasis on endpoint behavioral analytics .


Thus, Option B is the correct answer.

Question 2

A security architect is designing a threat model for a multi-tier cloud application that includes public APIs, backend microservices, and an identity provider. The goal is to identify how an attacker could chain multiple weaknesses together to achieve account takeover and data exfiltration. Which threat modeling technique is MOST appropriate?

  1. Option A:

    STRIDE analysis to enumerate threat categories per component

  2. Option B:

    CVSS scoring to prioritize vulnerabilities by severity

  3. Option C:
    Attack trees to model adversary objectives and paths
  4. Option D:

    DREAD scoring to assess impact and exploitability

Show answer and explanation

Correct answer: C

The correct answer is Attack trees . Attack trees are uniquely suited for modeling multi-step adversary behavior , which is essential when analyzing complex attack chains such as account takeover followed by data exfiltration.

Attack trees begin with a high-level attacker goal (for example, “Exfiltrate customer data”) and then break that goal into multiple branches representing different paths an attacker could take. These paths can include credential compromise, API abuse, privilege escalation, lateral movement, and persistence. This structure mirrors how real adversaries think and operate.

Option A (STRIDE) is useful for identifying broad threat categories—such as spoofing, tampering, or information disclosure—but it does not naturally capture sequential attack paths . Option B (CVSS) focuses on vulnerability severity scoring, not adversary behavior. Option D (DREAD) assesses risk impact but does not visualize how attacks unfold across systems.

For threat hunters and defenders, attack trees provide a shared mental model between architects, SOC teams, and red teams. They directly inform detection engineering by highlighting critical choke points where attacker behavior must occur, such as token abuse, API enumeration, or anomalous role assumption in cloud environments.

In modern cloud security, where breaches often involve multiple low-severity issues chained together , attack trees offer far greater strategic value than component-by-component analysis. They also align closely with MITRE ATT & CK mapping , enabling defenders to translate threat models into actionable hunts.

Thus, option C is the most appropriate and professionally validated answer.

See all 6 free sample questions