Updated Aug-2026 Official licence for 300-220 Certified by 300-220 Dumps PDF [Q82-Q101]

The correct answer ismonitoring NetFlow records for abnormal beaconing patterns. Cisco Secure Network Analytics is fundamentally abehavioral analytics platform, not a signature-based detection tool.
Advanced adversaries deliberately avoid known malicious infrastructure to bypass traditional IOC-based defenses. As a result, IP addresses, domains, and threat intelligence feeds (Options A and D) provide limited long-term value and sit at thelowest levels of the Pyramid of Pain.
Stealthwatch excels at detectingbehavioral anomalies in network traffic, particularly:
* Regular, low-volume outbound connections
* Consistent timing intervals (beaconing)
* Rare destination communication
* Protocol misuse over common ports (80/443)
These patterns are characteristic ofC2 traffic, even when encryption and legitimate cloud services are used.
By analyzingNetFlow telemetry, analysts can detect C2 behavior without needing to know the destination in advance.
Firewall logs (Option C) are reactive and lack behavioral context. They also miss allowed traffic, which is where most stealthy C2 operates.
This hunting technique aligns directly withCBRTHD blueprint objectivesrelated to:
* Network-based threat hunting
* Detecting command-and-control communications
* Moving detection higher on the Pyramid of Pain
Therefore,Option Bis the most effective and Cisco-aligned answer.

The correct answer isCredential Access. In the MITRE ATT&CK framework,password sprayingis classified under theCredential Access tactic (TA0006), specifically techniqueT1110.003 – Password Spraying. This classification is based on the attacker’s primary objective:gaining valid credentialsby systematically attempting a small number of common or weak passwords across many user accounts.
Password spraying differs from brute-force attacks in that it intentionally avoids rapid or repeated attempts against a single account, thereby evading account lockout controls and basic detection mechanisms. Instead, attackers “spray” one password (for example,Winter2025!orPassword123) across a large number of users, exploiting the likelihood that at least one account will use that password.
Although successful password spraying often leads toinitial access, MITRE classifies it underCredential Accessbecause the technique’s defining action is theacquisition of credentials, not the system entry itself.
Initial access is the outcome, while credential theft is the method. This distinction is critical for threat hunters, as it guides where detections and controls should be focused.
From a professional threat hunting perspective, defenders monitor authentication telemetry such as failed and successful logins across identity providers, VPNs, cloud services, and email platforms. Indicators include multiple authentication failures across many accounts from a single source IP, followed by one or more successful logins. Identity-centric logging and anomaly detection are foundational here, reinforcing the principle thatidentity is the primary attack surface in modern environments.
Understanding password spraying as a credential access technique helps organizations prioritize protections such as strong password policies, MFA enforcement, adaptive authentication, and detection logic tuned for low-and-slow authentication abuse.