KC-6 — Chapter 6 Knowledge Check
Questions and answer context for Chapter 6
Use this page after completing the chapter Knowledge Check. Each question is repeated so the answer and rationale retain their full instructional context.
Questions
Select the best answer for each question.
1. What is the fundamental difference between monitoring and threat hunting?
A. Monitoring is faster
B. Threat hunting only applies to network telemetry
C. There is no meaningful difference
D. Monitoring reacts to alerts; hunting proactively searches for activity that did not generate one
2. What should every threat hunt begin with?
A. A confirmed incident
B. A testable hypothesis
C. A completed report
D. A Caldera operation
3. Why do professional threat hunters organize hunts around adversary behavior (ATT&CK) rather than individual log sources?
A. It reflects how attackers actually operate and allows hunts to generalize across tools and telemetry sources
B. It is required by Wazuh licensing
C. Log sources are unreliable
D. ATT&CK replaces the need for telemetry
4. What is the purpose of Atomic Red Team in this lab?
A. To permanently compromise the Windows endpoint
B. To replace Wazuh’s detection engine
C. To safely execute a single, well-documented ATT&CK technique and validate whether it was detected
D. To generate Suricata rules automatically
5. Why should you always run the -Cleanup step after an Atomic Red Team test?
A. It is optional and rarely necessary
B. To remove artifacts the test created and restore the endpoint to a known state
C. It improves Wazuh Indexer performance
D. It is required before Wazuh will generate any alerts
6. How does Caldera differ from Atomic Red Team in typical use?
A. Caldera only works on Linux
B. They are functionally identical
C. Caldera does not use the MITRE ATT&CK framework
D. Caldera emulates multi-stage adversary campaigns using connected agents, while Atomic Red Team executes individual, isolated techniques
7. After running any adversary emulation test, what should you do immediately?
A. Delete the test results
B. Restart the Wazuh Indexer
C. Check Wazuh to confirm whether the expected telemetry and alerts actually appeared
D. Disable Sysmon
8. Why is verifying the source of an installer script before running it a professional habit worth building?
A. Scripts run with administrative privileges can cause significant harm if sourced from an untrusted or outdated location
B. It has no real security value
C. It is only relevant for Caldera
D. Wazuh performs this verification automatically
Answer Key
| Q | Answer | Why |
|---|---|---|
| 1 | D | Monitoring reacts to alerts; hunting searches for what generated none. |
| 2 | B | Every hunt begins with a testable hypothesis. |
| 3 | A | Behavior-based hunts generalize across tools and telemetry sources. |
| 4 | C | Atomic Red Team safely executes one documented ATT&CK technique. |
| 5 | B | -Cleanup removes test artifacts and restores a known state. |
| 6 | D | Caldera emulates multi-stage campaigns; ART runs isolated techniques. |
| 7 | C | Immediately verify whether expected telemetry and alerts appeared. |
| 8 | A | Admin-privileged scripts from untrusted sources can cause real harm. |