After a multi-week threat hunting exercise, a security team confirms that an attacker gained access...

The correct answer isDiscovery of unknown attacker behaviors and closure of detection gaps. This outcome best reflects thestrategic valueof threat hunting beyond incident response.

Threat hunting is not primarily about cleanup actions such as credential resets or file removal—those areincident response tasks. The real value of hunting lies in uncoveringpreviously undetected attacker behaviors, understanding how adversaries bypass controls, and translating those findings intoimproved detection and prevention.

Option A represents low-value indicators that attackers can easily change. Option C assumes malware was involved, which is not the case. Option D is necessary but tactical, not strategic.

By identifying credential misuse patterns, lateral movement paths, and data exfiltration techniques, the team can:

Create new SIEM and EDR detections

Harden identity and access controls

Reduce dwell time for future intrusions

Force attackers higher up the Pyramid of Pain

This demonstratesorganizational resilience, not just containment. Mature security programs measure success by how effectively theyeliminate blind spots, not how many alerts they close.

Thus, optionBis the correct answer.