Splunk SPLK-5001 Online Practice Questions and Exam Preparation

Splunk SPLK-5001 Online Questions & Answers

• Question 31:

  The field file_acl contains access controls associated with files affected by an event. In which data model would an analyst find this field?

  A. Malware
  B. Alerts
  C. Vulnerabilities
  D. Endpoint
  D. Endpoint

• Question 32:

  While testing the dynamic removal of credit card numbers, an analyst lands on using therexcommand. What mode needs to be set to in order to replace the defined values with X?

  | makeresults

  | eval ccnumber="511388720478619733"

  | rex field=ccnumber mode=???"s/(\d{4}-){3)/XXXX-XXXX-XXXX-/g"

  Please assume that the aboverexcommand is correctly written.

  A. sed
  B. replace
  C. mask
  D. substitute
  A. sed

• Question 33:

  The Lockheed Martin Cyber Kill Chain?breaks an attack lifecycle into several stages. A threat actor modified the registry on a compromised Windows system to ensure that their malware would automatically run at boot time. Into which phase of the Kill Chain would this fall?

  A. Act on Objectives
  B. Exploitation
  C. Delivery
  D. Installation
  D. Installation

• Question 34:

  An analysis of an organization's security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of implementing the new process or solution that was selected?

  A. Security Architect
  B. SOC Manager
  C. Security Engineer
  D. Security Analyst
  C. Security Engineer

• Question 35:

  Which of the following is considered Personal Data under GDPR?

  A. The birth date of an unidentified user.
  B. An individual's address including their first and last name.
  C. The name of a deceased individual.
  D. A company's registration number.
  B. An individual's address including their first and last name.

• Question 36:

  An analyst would like to test how certain Splunk SPL commands work against a small set of data. What command should start the search pipeline if they wanted to create their own data instead of utilizing data contained within Splunk?

  A. makeresults
  B. rename
  C. eval
  D. stats
  A. makeresults

• Question 37:

  The eval SPL expression supports many types of functions. Which of these function categories is not valid with eval?

  A. JSON functions
  B. Text functions
  C. Comparison and Conditional functions
  D. Threat functions
  D. Threat functions

• Question 38:

  Which of the following is a best practice for searching in Splunk?

  A. Streaming commands run before aggregating commands in the Search pipeline.
  B. Raw word searches should contain multiple wildcards to ensure all edge cases are covered.
  C. Limit fields returned from the search utilizing the cable command.
  D. Searching over All Time ensures that all relevant data is returned.
  A. Streaming commands run before aggregating commands in the Search pipeline.

• Question 39:

  A successful Continuous Monitoring initiative involves the entire organization. When an analyst discovers the need for more context or additional information, perhaps from additional data sources or altered correlation rules, to what role would this request generally escalate?

  A. SOC Manager
  B. Security Analyst
  C. Security Engineer
  D. Security Architect
  C. Security Engineer

• Question 40:

  A threat hunter executed a hunt based on the following hypothesis:

  As an actor, I want to plant rundll32 for proxy execution of malicious code and leverage Cobalt Strike for Command and Control.

  Relevant logs and artifacts such as Sysmon, netflow, IDS alerts, and EDR logs were searched, and the hunter is confident in the conclusion that Cobalt Strike is not present in the company's environment.

  Which of the following best describes the outcome of this threat hunt?

  A. The threat hunt was successful because the hypothesis was not proven.
  B. The threat hunt failed because the hypothesis was not proven.
  C. The threat hunt failed because no malicious activity was identified.
  D. The threat hunt was successful in providing strong evidence that the tactic and tool is not present in the environment.
  D. The threat hunt was successful in providing strong evidence that the tactic and tool is not present in the environment.