Splunk SPLK-5001 Online Practice Questions and Exam Preparation

Splunk SPLK-5001 Online Questions & Answers

• Question 41:

  The Security Operations Center (SOC) manager is interested in creating a new dashboard for typosquatting after a successful campaign against a group of senior executives. Which existing ES dashboard could be used as a starting point to create a custom dashboard?

  A. IAM Activity
  B. Malware Center
  C. Access Anomalies
  D. New Domain Analysis
  D. New Domain Analysis

• Question 42:

  An analysis of an organization's security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of designing the new process and selecting the required tools to implement it?

  A. SOC Manager
  B. Security Engineer
  C. Security Architect
  D. Security Analyst
  C. Security Architect

• Question 43:

  An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which the attacker is moving would be in which field?

  A. host
  B. dest
  C. src_nt_host
  D. src_ip
  D. src_ip

• Question 44:

  Which of the following use cases is best suited to be a Splunk SOAR Playbook?

  A. Forming hypothesis for Threat Hunting
  B. Visualizing complex datasets.
  C. Creating persistent field extractions.
  D. Taking containment action on a compromised host
  D. Taking containment action on a compromised host

• Question 45:

  The United States Department of Defense (DoD) requires all government contractors to provide adequate security safeguards referenced in National Institute of Standards and Technology (NIST) 800-171. All DoD contractors must continually reassess, monitor, and track compliance to be able to do business with the US government.

  Which feature of Splunk Enterprise Security provides an analyst context for the correlation search mapping to the specific NIST guidelines?

  A. Comments
  B. Moles
  C. Annotations
  D. Framework mapping
  D. Framework mapping

• Question 46:

  Which of the following is a best practice when creating performant searches within Splunk?

  A. Utilize the transaction command to aggregate data for faster analysis.
  B. Utilize Aggregating commands to ensure all data is available prior to Streaming commands.
  C. Utilize specific fields to return only the data that is required.
  D. Utilize multiple wildcards across fields to ensure returned data is complete and available.
  C. Utilize specific fields to return only the data that is required.

• Question 47:

  An IDS signature is designed to detect and alert on logins to a certain server, but only if they occur from 6:00 PM - 6:00 AM. If no IDS alerts occur in this window, but the signature is known to be correct, this would be an example of what?

  A. A True Negative.
  B. A True Positive.
  C. A False Negative.
  D. A False Positive.
  A. A True Negative.

• Question 48:

  The following list contains examples of Tactics, Techniques, and Procedures (TTPs):

  1.Exploiting a remote service

  2.Lateral movement

  3.Use EternalBlue to exploit a remote SMB server In which order are they listed below?

  A. Tactic, Technique, Procedure
  B. Procedure, Technique, Tactic
  C. Technique, Tactic, Procedure
  D. Tactic, Procedure, Technique
  A. Tactic, Technique, Procedure

• Question 49:

  When searching in Splunk, which of the following SPL commands can be used to run a subsearch across every field in a wildcard field list?

  A. foreach
  B. rex
  C. makeresults
  D. transaction
  A. foreach

• Question 50:

  Which of the following Splunk Enterprise Security features allows industry frameworks such as CIS Critical Security Controls, MITRE ATTandCK, and the Lockheed Martin Cyber Kill Chain?to be mapped to Correlation Search results?

  A. Annotations
  B. Playbooks
  C. Comments
  D. Enrichments
  A. Annotations