Threat Hunting Data Sources for Exploitable Systems

Answer Correct answer: C — Threat feeds provide the intelligence necessary for threat hunters to proactively identify active threats and TTPs within the network.

The primary goal of the threat-hunting team at a large company is to identify cyberthreats that the SOC has not detected. Which of the following types of data would the threat-hunting team primarily use to identify systems that are exploitable?

Vulnerability scan
Packet capture
Threat feed Correct Answer
User behavior

threat hunting data sources sy0-601 threat feeds comptia security plus threat intelligence difference between threat hunting and vuln scanning

Community Votes

42%

36%

22%

42% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the definition of threat hunting as a proactive process using threat intelligence (feeds) rather than reactive or static scanning tools.

This question explores the distinction between threat hunting and vulnerability management in identifying exploitable systems. It establishes that while scanning finds weaknesses, threat hunting leverages intelligence to find active threats.

Many candidates choose Vulnerability Scan (A) because it directly identifies exploitable systems, but this is a routine operational task typically handled by automated tools or the SOC, not the proactive, intelligence-driven process of threat hunting.

Community Discussion (16 comments)

slapster 👍 6 Selected: C

I'm a bit uncertain of my answer, however I'm leaning towards Threat Feed (C). According to CompTIA, "threat hunting is an assessment technique that utilizes insights gained from threat intelligence to proactively discover whether there is evidence of TTPs already present within the network or system. This contrasts with a reactive process that is only triggered when alert conditions are reported through an incident management system (Section 3C)." The question uses the word "primarily," which I am using to make my inference. I find it more reasonable that threat hunters will use threat feeds to identify exploitable systems, rather than sifting through packet capture files. Obviously, both threat feeds and packet capture can be integrated into a SIEM, which is where my uncertainty comes into play. Also are threat feeds considered to be threat intelligence rather than threat hunting? The semantics causes me to overthink it almost every time, however considering the above excerpt from CompTIA, threat feeds just strike me as more proactive than reactive compared to packet capture.

SM9 👍 1 Selected: B

https://blackcell.ae/why-packet-capture-is-an-important-tool-in-the-threat-hunting-toolbelt/

xBrynlee 👍 2 Selected: C

COMPTIA says "Where vulnerability scanning uses lists of patches and standard definitions of baseline configurations, threat hunting is an assessment technique that utilizes insights gained from threat intelligence to proactively discover whether there is evidence of TTPs already present within the network or system". This eliminates option A. Vulnerability scan. Darril Gibson mentions the tools used for threat hunting include OSINT, threat feeds, intelligence fusion (which combines all this data to create a picture of likely threats and risks for an organization. This helps the cybersecurity analysts understand how threat actors may maneuver through the network, how to detect them, and how to mitigate their efforts once they’re discovered)

AspiringNerd 👍 3 Selected: B

Gonna go with Packet Capture here.. Vulnerability Scanning looks for known vulnerabilities which the SOC team should already do. Threat hunters are gonna work slower and precise.. aka packet capture.

65333d6 👍 3 Selected: C

Within the Darril Gibson Sec+ SY0-601 Study Guide it identifies and lists Threat Feeds within its Threat Hunting section. Threat Hunting is the process of actively looking for threats within a network before an automated tool detects and reports on the threat. An important part of Threat Hunting is gathering data on the threat through threat intelligence. This knowledge comes from both internal and external sources. Threat Feeds provide subscribers with up-to-date information on current threats. Threat Feeds use both structured data reports and unstructured reports.

russian 👍 1 Selected: B

B. Packet capture Explanation: Packet capture means looking at the data going back and forth on the network. By checking this data, the team can find any strange or suspicious activity that might be a cyberthreat. It helps them find systems that could be attacked or already compromised. While other methods like scanning for vulnerabilities (Option A), checking threat updates (Option C), and watching user behavior (Option D) are useful, looking at the network data directly is the best way to spot potential problems

Ravnit 👍 1 Selected: D

given the context that the threat-hunting team is looking for cyberthreats that the SOC has not detected, focusing on anomalous user behavior could indeed be a more direct approach to identifying potentially exploitable systems that may have evaded detection. D. User behavior

_deleteme_ 👍 2

A - Threat hunting is looking for potential threats using monitoring tools. Vulnerability Scanning - Automated probing of systems, networks, and applications to discover potential vulnerabilities. The fastest way to look for a threat is to scan. Packet capturing is good but how long will take a while to find a potential threat by device? That's my take.

ps1hacker 👍 1 Selected: B

At first I was thinking vulnerability scan but its probably packet capture. All these can be right, but I think network traffic can give you the most valuable information to attack a network, seeing where all the data is going, what is secure and what is not etc. If nmap was an option I might go with that but given these are a bit more general I will say B.

MF757 👍 1 Selected: B

The threat-hunting team primarily uses packet capture data to identify systems that are exploitable by analyzing network traffic for suspicious or malicious activities.

TM78 👍 3 Selected: C

C. Threat feed. “Threat hunting is an active process of locating cyberattacks and mitigating them as they are discovered…Numerous sources provide information about cutting-edge attacks and security threats: intelligence infusion, threat feeds, and advisories and bulletins.” (Mike Meyers’ CompTia Security + 601 Cert Guide) Think STIX and TAXII.

StaticK9 👍 2 Selected: B

I agree with Rumcajs. B - Packet Capture

Rumcajs 👍 3 Selected: B

B. Packet capture Packet capture data provides a detailed record of network traffic, including the content of packets being transmitted between systems. By analyzing packet capture data, the threat-hunting team can identify suspicious or malicious activity that may indicate systems that are exploitable. This could include unusual network connections, patterns of communication indicative of malware or unauthorized access, or attempts to exploit vulnerabilities in network services or protocols

Payu1994 👍 2

Here it says Threats not detected before by the SOC team. SO Option B makes more sense.

RedDog2 👍 4 Selected: A

Vulnerability scanning is the process of identifying security weaknesses and flaws in systems and software running on them.

Hs1208 👍 3 Selected: A

A. Vulnerability scan to identify systems that are exploitable

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The correct answer is C, Threat Feed. Threat hunting is defined as a proactive, hypothesis-driven approach to finding indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) that have evaded automated detection. To do this effectively, hunters rely on threat intelligence gathered from external sources, known as threat feeds. These feeds provide real-time data on emerging attacks, malware signatures, and attacker TTPs, allowing the team to search their network for evidence of these specific activities. This aligns with CompTIA's definition that threat hunting "utilizes insights gained from threat intelligence."

Why the Other Options Are Wrong

Option A, Vulnerability Scan, is incorrect because vulnerability scanning is a systematic, automated process of identifying known security flaws (CVEs) in systems. While it identifies potential exploitability, it does not identify active threats or evidence that an attack is currently underway, which is the primary goal of threat hunting. Option B, Packet Capture, is a tool used during incident response or forensics to analyze traffic, but it is not the primary source of intelligence that drives the hypothesis of a threat hunt. Option D, User behavior, is analyzed through UEBA (User and Entity Behavior Analytics), which is often part of the SOC's monitoring stack, whereas threat hunting is broader and relies heavily on external context provided by threat feeds.

Community Comment Notes

Several commenters correctly identified Threat Feeds as the answer, citing official study guides like Darril Gibson’s and Mike Meyers’ books. For instance, one user noted that "threat hunting is an assessment technique that utilizes insights gained from threat intelligence," distinguishing it from vulnerability scanning. Another commenter emphasized the use of standards like STIX and TAXII, which are formats for exchanging threat feed data. Some users were confused by the word "exploitable," leaning towards Vulnerability Scans, but the key is that threat hunting uses external intel to find active exploitation attempts, not just static weaknesses.

Exam Strategy

When you see 'threat hunting' paired with 'data source' or 'intelligence,' look for answers related to external threat feeds, IOCs, or TTPs. Do not confuse threat hunting with vulnerability scanning (finding flaws) or penetration testing (proving exploitation). Threat hunting is about looking for presence of threats using intelligence.

Frequently Asked Questions

Why isn't Vulnerability Scanning the answer for threat hunting?

Vulnerability scanning identifies static weaknesses (flaws) in systems. Threat hunting actively searches for evidence of current attacks using external intelligence, making it a different, more dynamic process.

What role do Threat Feeds play in threat hunting?

Threat feeds supply real-time data on attacker TTPs and IOCs. Hunters use this intel to form hypotheses and search their environment for signs that these specific threats are present.

Related Analysis

← Back to SY0-601 Study Guide