Review questions

Answer the following questions to check your knowledge of this chapter:

1. (True or false) Cyber threat hunting is reactive in nature.
2. The NIST incident response life cycle is made up of which four stages?
   1. Preparation, Detection and Analysis, Re-Baselining Systems, Policy Alignment
   2. Planning, Preparation, Detection, Recovery
   3. Preparation, Detection and Analysis, Containment, Eradication, and Recovery, Post-Incident Activity
   4. Planning, Detection, Containment, Post-Incident Activity
3. Threat hunting is mainly a part of which phase of the NIST incident response life cycle?
4. (True or false) Threat hunting is unique to cyber defense.
5. (Insert the correct answer) Steady-state defenses such as incident response will normally want low ______ _______ rates. Threat hunters will normally want high ______ ______ rates.
   • False positive
   • True positive
   • False negative
   • True negative