Cisco 300-220 Practice Exam Questions & Answers

The correct answer is Transitioning from reactive to proactive threat hunting to identify unknown threats and vulnerabilities. This directly aligns with both the Threat Hunting Maturity Model and the strategic goals of the Pyramid of Pain, which emphasizes increasing the adversary's cost by detecting behaviors and tactics rather than easily changeable indicators.

Reactive security operations focus on alerts, signatures, and known indicators such as hashes, IP addresses, and domains---the lowest and least painful levels of the Pyramid of Pain. While necessary, these controls are easily bypassed by sophisticated adversaries. Proactive threat hunting represents a higher maturity level, where analysts actively search for unknown, stealthy, or novel attacker behaviors that have not yet triggered alerts.

Option D (automating detection of known threats) improves efficiency but does not meaningfully increase adversary pain, as attackers can rapidly change known indicators. Option B provides preparedness benefits but does not directly shift detection capabilities. Option A focuses on compliance, which is necessary for governance but largely irrelevant to adversary behavior.

By transitioning to proactive hunting, organizations focus on TTP-based detection, such as credential misuse patterns, abnormal lateral movement, persistence mechanisms, and command-and-control behaviors. These detections operate higher in the Pyramid of Pain---tactics, techniques, and procedures---forcing attackers to significantly retool and increasing the likelihood of early detection.

From a CISO-level perspective, this shift reflects mature security leadership: compliance keeps you legal, automation keeps you efficient, but proactive threat hunting keeps you resilient against advanced threats.

The correct answer is Exploit public-facing application. The log excerpt in the exhibit clearly shows a malicious HTTP GET request targeting a WordPress plugin PHP file with a crafted SQL injection payload:

UNION ALL SELECT CONCAT(...)

This syntax is a classic indicator of SQL injection, a well-documented attack technique used to exploit insufficient input validation in web applications. According to the MITRE ATT&CK framework, this behavior maps to the Initial Access tactic (TA0001) and the technique Exploit Public-Facing Application (T1190). The attacker is directly interacting with a publicly accessible web service and abusing a vulnerability in the application code to gain unauthorized access.

From a threat hunting and forensic standpoint, this is a textbook example of how attackers commonly achieve initial access to web servers. The attacker did not authenticate via remote services (such as SSH or RDP), nor did they rely on user interaction (as in a drive-by compromise). Instead, they sent a specially crafted request to a vulnerable endpoint exposed to the internet. This makes option B incorrect because External Remote Services requires legitimate service access mechanisms. Option C is also incorrect because Command and Scripting Interpreter is typically used after initial access, once code execution is already achieved. Option D does not apply because there is no evidence of malicious content being delivered to end users.

The forensic team's actions---isolating the server, cloning the disk, and analyzing logs---are standard post-incident procedures to reconstruct the attack chain. Web server access logs are especially valuable in these cases, as they often reveal malicious payloads, attacker IP addresses, targeted endpoints, and timestamps.

For defenders and threat hunters, this scenario reinforces the importance of monitoring web logs for anomalous query strings, enforcing secure coding practices, conducting regular vulnerability scans, and promptly patching third-party plugins. Public-facing applications remain one of the most exploited initial access vectors, making this technique a critical focus area in modern threat hunting programs.

The correct answer is consistent attacker tradecraft mapped to MITRE ATT&CK. Attribution at a professional level relies on behavioral consistency, not superficial artifacts.

Advanced threat actors routinely rotate infrastructure, recompile malware, and vary filenames specifically to defeat attribution efforts. As a result, indicators such as IP addresses, hashes, and timestamps are unreliable and sit low on the Pyramid of Pain.

What attackers cannot easily change is how they operate. This includes:

Initial access techniques

Credential harvesting methods

Lateral movement patterns

Persistence mechanisms

Command-and-control behaviors

When these behaviors remain consistent across incidents, they form a behavioral fingerprint. Mapping these observations to MITRE ATT&CK techniques allows analysts to compare activity against known threat group profiles maintained by intelligence providers and national CERTs.

Option A and B are weak indicators easily altered by attackers. Option D provides almost no attribution value, as timing alone is coincidental and unreliable.

Professional attribution requires correlating TTPs across campaigns and validating them against historical threat actor intelligence. This method supports high-confidence attribution used in legal, executive, and geopolitical contexts.

Therefore, Option C is the correct and defensible answer.

The correct answer is authentication and remote execution logs. Lateral movement using legitimate tools relies heavily on credential use and remote management protocols, not malware execution.

Attackers commonly use:

RDP

SMB administrative shares

WinRM

WMI

SSH

These techniques generate authentication events, remote logons, and service execution logs rather than malware alerts. Antivirus tools are ineffective here because no malicious binaries are involved.

Option A is ineffective against living-off-the-land attacks. Option B is unrelated to lateral movement. Option D may show some activity but lacks the necessary depth to identify privilege misuse or session hopping.

Authentication telemetry enables hunters to detect anomalies such as:

Logons between non-associated systems

Sudden administrative access

Credential reuse across hosts

Abnormal session timing and frequency

This data is foundational for credential-based attack detection, which remains one of the most common breach paths today. It also aligns with MITRE ATT&CK Lateral Movement and Credential Access tactics.

Thus, option C is the correct answer.

The correct answer is small, periodic outbound connections to a rare destination. Beaconing is a hallmark of command-and-control (C2) communication, particularly in stealthy malware campaigns.

Attackers design C2 channels to:

Minimize bandwidth usage

Blend into normal traffic

Avoid triggering threshold-based alerts

As a result, beaconing traffic often consists of low-volume, regular intervals connecting to the same external destination. Cisco Secure Network Analytics is purpose-built to detect this type of behavioral anomaly using NetFlow and telemetry analysis.

Option A suggests data exfiltration rather than beaconing. Option B is too broad and unspecific. Option D relates to denial-of-service or scanning activity, not C2.

This hunting technique aligns with MITRE ATT&CK -- Command and Control and is explicitly covered in the CBRTHD blueprint under network-based threat hunting. Detecting beaconing behavior forces attackers to significantly alter their communication strategy, increasing their operational cost.

Therefore, Option C is the correct and Cisco-aligned answer.

The correct answer is Files are encrypted. The exhibit shows a collection of API calls and strings that strongly indicate cryptographic operations associated with file encryption, a common behavior in ransomware and data-encrypting malware.

Key indicators in the script include multiple Windows Cryptographic API function calls such as:

CryptAcquireContextW

CryptCreateHash

CryptHashData

CryptDeriveKey

CryptEncrypt

CryptDecrypt

CryptDestroyKey

CryptReleaseContext

These APIs are part of the Windows CryptoAPI, which is explicitly used to generate cryptographic keys, hash data, and encrypt or decrypt content. The presence of ADVAPI32.dll further confirms cryptographic functionality, as this library provides access to Windows security and encryption services.

Additionally, registry-related APIs such as RegSetValueExA, RegOpenKeyExA, and references to:

Software\Microsoft\Windows\CurrentVersion\Run

indicate that the script may also establish persistence, ensuring the encryption routine executes again after reboot. However, persistence is secondary; the primary functional behavior shown is encryption.

Option A is incorrect because there are no APIs related to disabling networking (such as InternetSetOption or firewall manipulation). Option B is incorrect because retrieving host version information would involve system query APIs like GetVersionEx, which are not present. Option C is incorrect because although the word sleep appears, it is commonly used by malware to delay execution or evade sandboxes---not to place the system into sleep mode.

From a threat hunting and malware analysis perspective, the combination of CryptoAPI usage, registry modification, and internet-related APIs (InternetReadFile, InternetQueryDataAvailable) is a classic ransomware pattern: retrieve data or keys, encrypt local files, and possibly communicate with command-and-control infrastructure.

Professional defenders recognize these API patterns as high-confidence malicious indicators, often mapped to MITRE ATT&CK -- Impact: Data Encrypted for Impact (T1486). Detecting such behavior early is critical to prevent widespread data loss and operational disruption.

In summary, the script's API usage clearly indicates that its execution results in file encryption, making Option D the correct answer.

The correct answer is SQL injection. The decoded HTTP request shown in the exhibit contains multiple unmistakable indicators of a SQL injection attack, including the use of SQL keywords and functions such as SELECT, CASE, SUBSTRING, ASCII, BIN, and conditional SLEEP() statements. These elements are characteristic of time-based blind SQL injection, a technique attackers use to extract database information when direct query results are not visible.

From a professional cybersecurity perspective, the presence of expressions like:

SELECT (CASE WHEN ... THEN SLEEP(x))

SUBSTRING(password,1,1)

ASCII() and binary conversions

indicates that the attacker is probing the backend database character by character and using response timing to infer whether conditions are true or false. This is a well-known exploitation method used when error messages or query output are suppressed by the application.

The use of Base64 encoding does not represent the attack itself but rather an obfuscation technique to evade basic web application firewall (WAF) signatures and logging visibility. Encoding payloads allows attackers to bypass simple pattern-matching defenses, but once decoded, the underlying SQL injection becomes evident.

Option A (Unicode encoding) is incorrect because Unicode is commonly used for evasion, not exploitation. Option C (directory traversal) typically involves sequences like ../ to access filesystem paths, which are not present. Option D (XSS) targets client-side script execution and would include JavaScript payloads rather than database-focused logic.

According to the MITRE ATT&CK framework, this activity maps to Initial Access -- Exploit Public-Facing Application (T1190). SQL injection remains one of the most exploited vulnerabilities in public-facing applications due to poor input validation and insecure coding practices.

For threat hunters and defenders, this scenario reinforces the importance of deep payload inspection, decoding obfuscated requests, monitoring for anomalous database query behavior, and enforcing secure development practices such as parameterized queries and input sanitization. SQL injection continues to be a high-impact, real-world attack vector despite being well understood, making it a critical focus area in web application threat hunting.