What is the primary goal of incident hunting?

• A. Reduce the dwell time of attackers
• B. Eliminate all incidents instantly
• C. Comply with regulations
• D. Detect all malware

Answer: (A)

The main idea behind incident hunting is to proactively find adversaries who have slipped past defenses and to shorten the time they remain inside the network. By hunting, you search for hidden threats, determine how they got in, and detect their activity early so you can contain and remediate faster. Reducing dwell time directly lowers risk because attackers have less opportunity to move laterally, escalate privileges, or exfiltrate data.

Why this fits best: while it’s good to improve overall security, hunting is not about instantly eliminating every incident—no defense can guarantee that. It’s also not about making compliance the primary aim, nor about catching every piece of malware in existence. Hunting focuses on uncovering stealthy intruders quickly and driving down the period they can operate undetected.