Threat Research and Contextual Analysis Questions

Focuses on investigating and contextualizing potential security threats and suspicious activity. Topics include consuming and evaluating threat intelligence feeds, researching known malware and adversary techniques, analyzing logs and telemetry to identify anomalous behavior, establishing environmental baselines, and using behavioral analysis to distinguish normal activity from malicious actions. Covers triage and enrichment of findings, building and validating indicators of compromise, threat hunting methodologies, mapping observations to tactics and techniques, assessing risk and impact, and communicating context and confidence to stakeholders. Candidates may be asked about tools, investigative workflows, false positive reduction, and how they determine whether an activity is benign, suspicious, or malicious given organizational context.