Threat hunting is a proactive cybersecurity technique that involves searching for indicators of compromise or signs of intrusion within an organization's network or systems. Unlike automated detection systems, threat hunting is typically carried out by security analysts who use their knowledge and intuition to identify subtle, unusual patterns that may indicate a security breach. The goal of threat hunting is to identify and mitigate threats before they can cause significant damage.
The CBROPS course material covers the concept of threat hunting as part of the skill set required for cybersecurity operations analysts, who are responsible for identifying and mitigating cyber threats

When analyzing a pcap file, data encryption can pose a significant challenge in terms of visibility. Encrypted data cannot be easily inspected, which means that the analyst may not be able to view the contents of the network packets to detect suspicious activity.
The answers are based on the general knowledge of host-based firewalls and the challenges faced during the analysis of pcap files in cybersecurity, as outlined in Cisco's cybersecurity documentation and resources.

The analyst is in the detection and analysis phase of the incident response process according to NIST SP800-
61. In this phase, events are detected and analyzed to determine whether they constitute incidents that require a response. It involves monitoring security events or data collection, correlation, and analysis of log entries and network flow data, among others. The goal is to identify incidents quickly so that appropriate actions can be taken. References := NIST SP800-61, Computer Security Incident Handling Guide, Section 3.2: Detection and Analysis

The correct display filter for analyzing FTP traffic in a PCAP file is "tcp.port==21". This filter will show all TCP packets where the port number is 21, which is the standard port for FTP control messages.