CompTIA CySA+ (CS0-002) — Question 392

Which of the following is MOST important when developing a threat hunting program?

Answer options

• A. Understanding penetration testing techniques
• B. Understanding how to build correlation rules within a SIEM
• C. Understanding security software technologies
• D. Understanding assets and categories of assets

Correct answer: D

Explanation

The correct answer is D, as having a clear understanding of assets and their categories is essential for effective threat hunting. This knowledge allows hunters to identify what needs protection and prioritize their efforts. The other options, while important, do not directly address the foundational knowledge required for a successful threat hunting program.