Which of the following describes a Hunting Organization?

• A. Security patrols
• B. Actively looking for incidents
• C. Known malware and variants
• D. Patterns of activity: evil versus normal

Answer: (B)

The main idea being tested is proactive threat hunting. A hunting organization is defined by its ongoing effort to actively search for threats and incidents rather than waiting for alerts to trigger a response. This means forming hypotheses about how adversaries might operate in the environment and then combing through data from endpoints, networks, and logs to confirm or refute those hypotheses. This proactive, hypothesis-driven approach helps uncover stealthy or previously unseen threats that signature-based or purely reactive methods might miss.

So the description that best fits is actively looking for incidents. Security patrols describe routine monitoring in some contexts, but not the proactive, hunting mindset. Focusing on known malware and variants emphasizes signatures rather than the broader act of seeking out threats. Describing patterns of activity as evil versus normal relates to analytics, but it doesn’t capture the organizational goal of actively hunting for incidents across the environment.