Conducting Threat Hunting and Defending using Cisco Technologies for CyberOps 300-220 Exam Questions
Preparing for the 300-220 exam is simple with Certs Vault. We offer easy-to-understand study materials that help you learn the most important exam topics. You can study using our PDF questions, practice online with a real exam-style test, or use the desktop practice software. Choose the study method that works best for you and prepare at your own pace.
At Certs Vault, we keep our 300-220 practice questions up to date. Whenever the exam syllabus or objectives change, we update our study materials so you always learn the latest topics. This helps you save time, avoid outdated content, and feel more confident when you take your exam.
A SOC team wants to detect lateral movement performed using legitimate administrative tools rather than malware. Which telemetry source provides the MOST reliable visibility for this hunting objective?
Correct Answer: C
The correct answer is authentication and remote execution logs . Lateral movement using legitimate tools relies heavily on credential use and remote management protocols , not malware execution.
Attackers commonly use:
RDP
SMB administrative shares
WinRM
WMI
SSH
These techniques generate authentication events, remote logons, and service execution logs rather than malware alerts. Antivirus tools are ineffective here because no malicious binaries are involved.
Option A is ineffective against living-off-the-land attacks. Option B is unrelated to lateral movement. Option D may show some activity but lacks the necessary depth to identify privilege misuse or session hopping.
Authentication telemetry enables hunters to detect anomalies such as:
Logons between non-associated systems
Sudden administrative access
Credential reuse across hosts
Abnormal session timing and frequency
This data is foundational for credential-based attack detection , which remains one of the most common breach paths today. It also aligns with MITRE ATT & CK Lateral Movement and Credential Access tactics .
Thus, option C is the correct answer.