300-220 Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity Exam Topics and Questions

This is the heaviest topic and it sets the conceptual foundation for everything that follows. You need to understand how hunting matures, how threats are modelled, and where detection tools fall short. The Pyramid of Pain and frameworks like MITRE ATT&CK appear throughout the exam, so weak coverage here will cost you across multiple domains.

– Maturity, models and frameworks

The Threat Hunting Maturity Model describes how an organisation progresses from reactive detection to proactive hunting, and the exam ties this to the Pyramid of Pain. You need to know which indicators are trivial to change and which force an attacker to invest real effort. MITRE ATT&CK organises adversary behaviour into tactics and techniques, while CAPEC focuses on attack patterns and TaHiTI on threat intelligence handling. PAST is less widely known but still appears in the outline. The exam expects you to apply these models to a scenario, not recite definitions. Know when each framework is the right tool and what it reveals about adversary intent or capability.

– Detection limits and automation trade-offs

Detection tools have blind spots. Malware can propagate without triggering signatures, and behaviour-based detection generates noise that buries real threats. The exam asks you to identify these limiting factors in context. Automation through machine learning and artificial intelligence can scale analysis, but it also introduces false confidence and requires tuning that many SOCs lack. You need to articulate both the operational advantage and the risk of over-reliance. The question is not whether automation is good or bad, but where it helps and where human judgement remains essential.

– Attribution and intelligence interpretation

Advanced persistent threats operate differently from commodity malware. APTs use custom tooling, longer dwell times, and deliberate operational security. Commodity threats are noisier and less patient. The exam gives you logs or a threat intelligence report and asks you to draw conclusions about the actor's sophistication, intent, and TTPs. You need to distinguish tactical choices from resource constraints. A report might describe techniques, procedures, or changes in behaviour over time. Your job is to interpret what those changes mean for detection and response, not to summarise the report's narrative.

How Threat Hunting Fundamentals is tested

Twenty percent of the exam means you will see multiple items from this topic, and they test application rather than recall. You might be given a scenario describing an organisation's current detection capability and asked which maturity level it represents, or which layer of the Pyramid of Pain a proposed indicator targets. Another common pattern is presenting a set of observed behaviours and asking you to map them to MITRE ATT&CK tactics or techniques. Candidates lose marks when they confuse the frameworks or misread the scenario's context. A technique might fit multiple tactics, and the correct answer depends on what the attacker is trying to achieve at that moment. Read the stem carefully and match the model to the evidence, not to what you expect the answer to be.

Where the first topic introduced the frameworks, this one asks you to choose and use them. You need to know when structured hunting is appropriate and when unstructured methods are better, and you need to prioritise attacks using both the Cyber Kill Chain and MITRE models. Ten percent is a moderate weighting, but the skills tested here underpin the heavier topics that follow.

– Selecting and applying models

Different scenarios call for different threat modelling approaches. MITRE ATT&CK maps adversary tactics and techniques to real-world behaviour, and you need to recognise when a change in TTPs signals a shift in adversary intent or capability. The Cyber Kill Chain stages an attack from reconnaissance to actions on objectives, and CAPEC describes attack patterns at a more abstract level. The exam gives you a scenario and asks which model fits the need. Structured hunting follows a hypothesis and a defined process. Unstructured hunting is exploratory and relies on intuition or anomaly detection. You need to know when each approach is justified and what it costs in time and analyst effort.

– Prioritisation and intelligence handling

Not every alert deserves the same response. The Cyber Kill Chain helps you understand how far an attack has progressed, and MITRE ATT&CK reveals which techniques are in play. CAPEC adds a layer of abstraction that can help you generalise from one attack to a class of similar threats. The exam asks you to rank attacks by severity or likelihood based on these models. Threat intelligence handling covers the full lifecycle: gathering data from multiple sources, cataloguing it so it remains searchable, using it to inform detection and response, and removing it when it becomes stale. Candidates who treat intelligence as static miss the point. It decays, and you need to know when to discard it.

How Threat modeling techniques is tested

Items from this topic present a scenario and ask you to choose the right model or prioritise a set of alerts. You might see a description of observed activity and be asked whether structured or unstructured hunting is the better fit, or you might be given a list of attacks at different stages and asked to rank them by urgency. The Cyber Kill Chain and MITRE ATT&CK both appear, sometimes in the same item, and the correct answer depends on what the question is optimising for: stage of attack, likelihood of success, or impact if completed. Candidates lose marks when they default to one model without considering what the scenario actually requires. Intelligence handling questions test the lifecycle, not just the collection phase. Know when to retire a feed.

Attribution is hard, and this topic tests your ability to extract TTPs from incomplete data. You will work with logs, interpret actor behaviour, and decide whether observed activity is an authorised test or a real attack. At twenty percent, this topic carries the same weight as the fundamentals, and it demands careful reading of evidence rather than pattern matching to known threat groups.

– Extracting TTPs from logs and intelligence

Logs do not announce an attacker's identity. You infer it from tactics, techniques, and procedures. The exam gives you log excerpts or a summary of observed behaviour and asks you to identify the TTP or map it to a framework. You might see command-line activity, network traffic, or file system changes. The question is what those artifacts reveal about intent and capability. Interpreting TTPs from a threat report is different. The report has already done some analysis, and your job is to translate that into actionable detection or response. Candidates who skim the details miss the nuance that separates one actor from another.

– Distinguishing authorised tests from attacks

Penetration testers and threat actors use similar tools and techniques, but their timelines, payloads, and coordination differ. The exam presents a scenario and asks whether the activity is an authorised assessment or an attack. You need to look at delivery method, timing, and whether the behaviour aligns with a known test plan. An unexpected payload or a technique that falls outside the agreed scope suggests compromise. The Pyramid of Pain is relevant here because higher-level artifacts like TTPs are harder for an attacker to change and more useful for attribution. Hash values and IP addresses are trivial to rotate. Procedural patterns are not.

How Threat actor attribution techniques is tested

Twenty percent means multiple items, and they test your ability to read evidence without jumping to conclusions. You might be shown a sequence of commands and asked which tactic is in play, or given a timeline and asked whether it fits an authorised test or an intrusion. The Pyramid of Pain appears in questions about which artifacts are most useful for detection. Hash values are easy to collect but easy to change. Techniques and procedures are harder to observe but more durable for attribution. Candidates lose marks when they treat all indicators as equal or when they attribute based on a single data point. The exam rewards synthesis. You need to combine multiple artifacts and consider what they reveal together, not in isolation.

This is the most operationally detailed topic. You need to know how to augment detection with scripting, hunt in cloud environments, analyse endpoint artifacts, and recognise command-and-control traffic. Memory-resident attacks and code-level analysis appear here, as do IoT considerations. Twenty percent means this topic will test breadth and depth in equal measure.

– Scripting, cloud, and endpoint analysis

Python and PowerShell let you automate repetitive analysis tasks and enrich detection logic that commercial tools cannot express. The exam expects you to know when scripting adds value and what it can achieve. Cloud-native threat hunting is different from on-premises work because visibility, logging, and control planes vary by provider. You need to understand what artifacts a cloud environment exposes and where blind spots exist. Endpoint artifacts include registry keys, scheduled tasks, browser history, and file metadata. Undetected threats often leave traces at the endpoint that network monitoring misses. Command-and-control communications can be identified through endpoint applications, running processes, or logs that show beaconing behaviour or unusual outbound connections.

– Session data, traffic analysis, and code inspection

Session and protocol data reveal patterns that individual packets do not. Unusual timing, unexpected protocols, or traffic to uncommon ports can indicate compromise. The exam asks you to select which activity is suspicious given the context. Determining the stage of infection from C2 traffic requires you to recognise reconnaissance, initial access, persistence, and exfiltration patterns in network data. Code-level analysis tools like PE Checker, BURP Suite, and SEM Grep help you identify weaknesses before they are exploited. You need to know what each tool does and when to use it. IoT devices run stripped-down operating systems and applications that require different analysis techniques. The exam describes the constraint and asks how you would adapt your process.

– Memory analysis, signatures, and attack vectors

Memory-resident attacks do not touch disk, so traditional forensics miss them. Tools like Volatility extract running processes, network connections, and injected code from memory dumps. The exam expects you to know what memory analysis can reveal and how the process differs from disk-based investigation. Constructing a signature means writing a rule that detects a specific behaviour or artifact without generating excessive false positives. You need to balance specificity and durability. Recognising the likelihood of attack by vector means understanding which entry points are plausible given the environment. A web application is a different attack surface from an air-gapped industrial control system, and the exam tests whether you can match threat to context.

How Threat hunting techniques is tested

This topic tests operational skill, so expect scenarios that describe an environment and ask what technique or tool applies. You might see a description of network traffic and be asked which stage of the kill chain it represents, or be given endpoint data and asked what artifact would confirm persistence. Memory analysis questions describe what was found in a dump and ask you to interpret it. Code analysis items ask you to select the right tool for a given weakness or to recognise what a tool's output means. Candidates lose marks when they choose a technique that works in theory but does not fit the scenario's constraints. Cloud environments, IoT devices, and memory-only attacks each impose limits on what you can see and do. The correct answer respects those limits.

Process is what turns individual techniques into repeatable capability. This topic asks you to identify memory-resident attacks, reverse engineer compromises, find detection gaps, and build runbooks that others can follow. You also need to recommend tools, configurations, and remediation strategies. Twenty percent makes this one of the four pillars of the exam, and it rewards candidates who think in systems rather than one-off wins.

– Memory attacks, reverse engineering, and detection gaps

Identifying memory-resident attacks requires a process, not a single tool. You need to know what to look for in memory, how to extract it, and how to validate your findings. Reverse engineering lets you determine how a compromise occurred by working backward from observed effects to initial access. The exam describes a scenario and asks you to outline the process or identify the next step. Detection gaps fall into three categories: vulnerabilities that have not been patched, configuration errors that weaken defences, and threats that existing tools do not cover. You need to distinguish between them because the remediation differs. Interpreting data from memory-specific tools means understanding what Volatility or similar platforms output and what it tells you about running processes, loaded drivers, or network state at the time of capture.

– Runbooks, playbooks, and tool recommendations

A runbook or playbook turns a detection into a response. The exam gives you a detectable scenario and asks you to construct the steps an analyst should follow. This includes triage, containment, evidence collection, and escalation criteria. Recommending tools, configurations, detection rules, or deception techniques requires you to match capability to need. A honeypot is useful in some environments and a liability in others. The same applies to endpoint detection, network taps, or SIEM correlation rules. You need to know what each option costs in complexity, visibility, and false positive rate.

– Remediation, hunt improvement, and countermeasures

Remediation strategies depend on the results of a threat assessment. If the attacker has achieved persistence, you need to remove it without alerting them. If they are still in reconnaissance, you might deploy deception to observe their next move. The exam presents a scenario and asks what you would recommend. Improving the effectiveness and efficiency of a threat hunt means identifying what slowed you down or what you missed, then changing process, tooling, or analyst training. Security countermeasures and mitigations address identified risks at the source. You need to recommend controls that reduce likelihood or impact, and you need to justify the trade-off in cost and operational friction.

How Threat hunting processes is tested

Process questions test whether you can sequence steps, not just name techniques. You might be asked to describe how you would identify a memory-resident attack, or to interpret the output of a memory analysis tool and decide what it means for the investigation. Runbook and playbook items give you a scenario and ask what the documented response should include. Detection gap questions describe an environment and ask you to identify what is missing: a patch, a configuration change, or a new detection rule. Remediation and improvement items test judgement. You need to weigh the options and choose the one that fits the constraints. Candidates lose marks when they recommend a control that is theoretically sound but operationally impractical, or when they miss the gap the scenario is pointing at.

The final topic is about what happens after the hunt. You need to diagnose analytical gaps, recommend mitigations, advance your organisation's maturity, and communicate findings to stakeholders who may not be technical. Ten percent is a smaller weight, but the skills tested here determine whether your hunting work translates into organisational change.

– Integration, gaps, and mitigation

Multiproduct integration means data from one tool enriches analysis in another. A SIEM correlates endpoint telemetry with network logs, or a threat intelligence platform annotates alerts with actor attribution. The exam asks how integration enhances visibility or accelerates analysis. Diagnosing analytical gaps using threat hunting methodologies means identifying what your current process cannot see or cannot answer. You might have visibility into network traffic but no endpoint coverage, or you might have alerts but no way to prioritise them. The gap is not always a missing tool. Sometimes it is a missing hypothesis or a flawed assumption. Recommending a mitigation strategy to block C2 traffic requires you to understand how the attacker communicates and where you can interdict without breaking legitimate services.

– Maturity, detection, and communication

Advancing to the next phase of the Threat Hunting Maturity Model requires investment in people, process, or technology. The exam describes your current state and asks what change would move you forward. Sometimes it is automation. Sometimes it is analyst training. Sometimes it is executive buy-in. Recommending changes to a detection methodology means identifying where your current approach generates false negatives or false positives, then proposing a refinement. This might mean tuning a rule, adding a data source, or changing the hypothesis you are testing. Using presentation resources to convey findings means translating technical detail into a narrative that drives action. You need to know what your audience cares about and what evidence will persuade them.

How Threat hunting outcomes is tested

Outcomes questions test whether you can close the loop from detection to response to improvement. You might be asked how integrating two products would change what you can see, or what gap a failed hunt reveals. Mitigation questions present a C2 channel and ask how you would block it without collateral damage. Maturity questions describe an organisation's current capability and ask what investment would advance them. Detection methodology items describe a problem with current rules or process and ask you to recommend a fix. Communication questions are less common but they test whether you can identify what a non-technical stakeholder needs to hear. Candidates lose marks when they recommend a change that does not address the root cause, or when they assume more budget or more tools when the real gap is process or skill.