100+ Free OffSec Threat Hunter Practice Questions
Pass your OffSec Threat Hunter (OSTH / TH-200) exam on the first try — instant access, no signup required.
A hunter is in the Prepare phase of a PEAK hunt. Which activity is MOST appropriate for this phase?
Explore More OffSec Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
Key Facts: OffSec Threat Hunter Exam
8 hr
Practical Exam
Online proctored hands-on scenario
24 hr
Report Window
Technical report submission after the lab
$1,749
Bundle Fee
TH-200 Course + Cert
7
TH-200 Modules
From fundamentals to behavioral hunting
54 hr
Course Content
TH-200 self-paced learning
200
Course Level
Foundational defensive certification
OSTH (OffSec Threat Hunter, TH-200) is a foundational defensive certification with an 8-hour hands-on proctored exam plus a 24-hour report submission, priced at $1,749 for the Course + Cert bundle. The credential validates proactive, hypothesis-driven threat hunting against ransomware groups and APTs using the Pyramid of Pain, Hunt Maturity Model, PEAK framework, Diamond Model, and MITRE ATT&CK Enterprise. Hunters demonstrate skill with network analysis (Wireshark, tcpdump, Suricata), endpoint and EDR hunting (CrowdStrike Falcon, Microsoft Defender KQL), and SIEM hunting in Splunk (SPL, CIM, ESCU). Our 100-question MCQ bank reinforces the conceptual frameworks that underpin the hands-on lab.
Sample OffSec Threat Hunter Practice Questions
Try these sample questions to test your OffSec Threat Hunter exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1Which statement BEST describes proactive threat hunting as opposed to traditional alert-driven incident response?
2In David Bianco's Pyramid of Pain, which indicator type causes the MOST pain to an attacker when defenders detect it?
3Place these Pyramid of Pain levels in the CORRECT order from LEAST painful (bottom) to MOST painful (top).
4An organization relies almost entirely on automated SIEM and antivirus alerts and collects very little log data centrally. Which level of David Bianco's Hunting Maturity Model BEST describes them?
5What single capability differentiates an HM4 (Leading) organization from an HM3 (Innovative) organization in the Hunting Maturity Model?
6What does the acronym PEAK stand for in the PEAK Threat Hunting Framework developed by Splunk's SURGe team?
7Which of the following is NOT one of the three primary hunt types defined by the PEAK framework?
8A hunter is in the Prepare phase of a PEAK hunt. Which activity is MOST appropriate for this phase?
9The four vertices of the Diamond Model of Intrusion Analysis are:
10Which Diamond Model vertex BEST describes a malicious payload such as Cobalt Strike Beacon used in an intrusion?
About the OffSec Threat Hunter Exam
The OffSec Threat Hunter (OSTH) certification, earned through the TH-200 Foundational Threat Hunting course, validates a defender's ability to proactively detect and investigate adversaries through behavioral analysis, threat actor profiling, and the use of network and endpoint indicators. The exam is an 8-hour practical hunt in a simulated environment plus a 24-hour report. Our 100-question MCQ bank covers the conceptual scaffolding TH-200 builds on: the Pyramid of Pain, Hunt Maturity Model, PEAK framework, Diamond Model, MITRE ATT&CK Enterprise, the Cyber Kill Chain, threat-actor profiles (LockBit, BlackCat/ALPHV, CLOP, APT28, APT29, APT40, Lazarus, Sandworm), threat intelligence (STIX 2.1/TAXII 2.1, TLP 2.0, MISP, OpenCTI), IoC categories, network analysis with Wireshark/tcpdump/Suricata, endpoint and EDR hunting with CrowdStrike Falcon and Microsoft Defender KQL, Splunk SPL and CIM, and behavioral hunting techniques.
Assessment
8-hour proctored, hands-on threat hunting scenario in a simulated network, followed by a 24-hour technical report submission window. Our practice bank provides 100 conceptual MCQs that prepare you for the underlying frameworks (Pyramid of Pain, PEAK, MITRE ATT&CK, Diamond Model) and the SIEM/EDR analysis skills the practical assesses.
Time Limit
8 hours hands-on + 24 hours report submission
Passing Score
Practical pass/fail determined by OffSec graders against the rubric
Exam Fee
$1,749 (Course + Cert bundle) (OffSec online proctored)
OffSec Threat Hunter Exam Content Outline
Threat Hunting Fundamentals
Proactive hypothesis-driven hunting; Pyramid of Pain (hash -> IP -> domain -> artifact -> tool -> TTP); Hunt Maturity Model HM0-HM4; PEAK Prepare/Execute/Act with Knowledge; Diamond Model vertices and pivots; assume-breach mindset
Threat Actors and TTPs
Ransomware (LockBit, BlackCat/ALPHV, CLOP, MOVEit campaign); APTs (APT28 GRU, APT29 SVR, APT40 MSS, Lazarus DPRK, Sandworm); MITRE ATT&CK Enterprise TA0001-TA0040; Lockheed Cyber Kill Chain phases
Threat Intel and IoCs
STIX 2.1 / TAXII 2.1; TLP 2.0 (Red, Amber+Strict, Amber, Green, Clear); MISP, OpenCTI, Anomali; hashes, IPs, domains, URIs, mutexes, registry keys, JA3/JA3S, HASSH; entropy and DGA detection
Network Analysis
Wireshark display filters (http.request.method, dns.qry.name, tls.handshake.type); tcpdump BPF; Suricata/Snort rule headers, flow keyword, content/offset/depth; DNS tunneling and TXT exfil; C2 beaconing, jitter, low-and-slow
Endpoint and EDR
Process-tree anomalies; LOLBins (certutil, rundll32, mshta, bitsadmin, msbuild); persistence (Run keys, Scheduled Tasks, WMI subscription); PowerShell EID 4104/4103, AMSI bypass; PsExec and wmiexec lateral movement; Falcon CQL and Defender KQL
Hunting with SIEM and Splunk
SPL stats, eval, where, lookup, transaction, streamstats, tstats; Common Information Model (Authentication, Network_Traffic, Endpoint); ESCU detection content; SPL idioms for beacon detection and rare-pair stack ranking
Behavioral Hunting
Frequency / stack-ranking analysis; least-frequency long-tail analysis; time-series anomalies; data stacking; baseline hunts and baseline drift; M-ATH model-assisted threat hunts under PEAK
How to Pass the OffSec Threat Hunter Exam
What You Need to Know
- Passing score: Practical pass/fail determined by OffSec graders against the rubric
- Assessment: 8-hour proctored, hands-on threat hunting scenario in a simulated network, followed by a 24-hour technical report submission window. Our practice bank provides 100 conceptual MCQs that prepare you for the underlying frameworks (Pyramid of Pain, PEAK, MITRE ATT&CK, Diamond Model) and the SIEM/EDR analysis skills the practical assesses.
- Time limit: 8 hours hands-on + 24 hours report submission
- Exam fee: $1,749 (Course + Cert bundle)
Keys to Passing
- Complete 500+ practice questions
- Score 80%+ consistently before scheduling
- Focus on highest-weighted sections
- Use our AI tutor for tough concepts
OffSec Threat Hunter Study Tips from Top Performers
Frequently Asked Questions
What is the OffSec Threat Hunter (OSTH / TH-200) certification?
The OSTH is OffSec's foundational defensive certification earned through the TH-200 Foundational Threat Hunting course. It validates that a defender can proactively detect and investigate adversaries using behavioral analysis, threat actor profiling, and network and endpoint indicators of compromise. The exam is an 8-hour proctored, hands-on threat hunting scenario followed by a 24-hour report submission.
How much does the OSTH exam cost?
The OSTH course-and-certification bundle costs $1,749 USD and includes the TH-200 self-paced course, lab access, and one exam attempt. OffSec also offers Learn One ($2,749/year) and Learn Unlimited subscriptions that provide broader access. The OSTH is delivered through OffSec's online proctored platform.
What does the OSTH practical exam look like?
OSTH is a proctored 8-hour hands-on assessment in a simulated environment. You hunt across the network for compromised systems, document your findings, and submit a technical report within 24 hours after the proctored window closes. There are no multiple-choice questions on the real exam — our 100 MCQs are conceptual prep that builds the frameworks the hands-on hunt assumes.
What topics does the TH-200 course cover?
TH-200 has seven modules covering threat hunting concepts and methodologies, threat actors and TTPs (ransomware groups and APTs), threat intelligence and reports including the Traffic Light Protocol, network indicators of compromise (with Suricata-style IDS/IPS), endpoint hunting with CrowdStrike Falcon, hunting with Splunk SIEM, and behavioral analysis. The course is roughly 54 hours of content.
What frameworks should I master for OSTH?
The Pyramid of Pain (hash -> IP -> domain -> artifact -> tool -> TTP), the Hunting Maturity Model (HM0-HM4), Splunk SURGe's PEAK framework (Prepare, Execute, Act with Knowledge), the Diamond Model of Intrusion Analysis, MITRE ATT&CK Enterprise tactics (TA0001-TA0040), and the Lockheed Martin Cyber Kill Chain are the core conceptual frameworks for OSTH and threat hunting in general.
Do OffSec certifications expire?
OffSec credentials do not expire in the traditional sense, but OffSec offers a Continuing Education program that lets you mark your credential as 'active'. For the latest active-status policy, check OffSec's certification continuing-education page.
How long should I study for OSTH?
Most candidates spend 60-100 hours studying alongside the 54-hour TH-200 course over 6-10 weeks, including time on the Challenge Lab. Candidates with prior SOC, IR, or detection-engineering experience usually need less time on conceptual content and more time on the lab environment.