Splunk SPLK-5001 Online Practice Questions and Exam Preparation

Splunk SPLK-5001 Online Questions & Answers

• Question 51:

  In which phase of the Continuous Monitoring cycle are suggestions and improvements typically made?

  A. Define and Predict
  B. Establish and Architect
  C. Analyze and Report
  D. Implement and Collect
  C. Analyze and Report

• Question 52:

  A Cyber Threat Intelligence (CTI) team delivers a briefing to the CISO detailing their view of the threat landscape the organization faces. This is an example of what type of Threat Intelligence?

  A. Tactical
  B. Strategic
  C. Operational
  D. Executive
  B. Strategic

• Question 53:

  After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in another field called machine_name. What SPL could they use to find all relevant events across either field until the field extraction is fixed?

  A. | eval src = coalesce(src,machine_name)
  B. | eval src = src + machine_name
  C. | eval src = src . machine_name
  D. | eval src = tostring(machine_name)
  A. | eval src = coalesce(src,machine_name)

• Question 54:

  Which of the following data sources can be used to discover unusual communication within an organization's network?

  A. EDS
  B. Net Flow
  C. Email
  D. IAM
  B. Net Flow

• Question 55:

  Which of the following is the primary benefit of using the CIM in Splunk?

  A. It allows for easier correlation of data from different sources.
  B. It improves the performance of search queries on raw data.
  C. It enables the use of advanced machine learning algorithms.
  D. It automatically detects and blocks cyber threats.
  A. It allows for easier correlation of data from different sources.

• Question 56:

  Which of the following is not considered an Indicator of Compromise (IOC)?

  A. A specific domain that is utilized for phishing.
  B. A specific IP address used in a cyberattack.
  C. A specific file hash of a malicious executable.
  D. A specific password for a compromised account.
  D. A specific password for a compromised account.

• Question 57:

  Which stage of continuous monitoring involves adding data, creating detections, and building drilldowns?

  A. Implement and Collect
  B. Establish and Architect
  C. Respond and Review
  D. Analyze and Report
  A. Implement and Collect

• Question 58:

  While the top command is utilized to find the most common values contained within a field, a Cyber Defense Analyst hunts for anomalies. Which of the following Splunk commands returns the least common values?

  A. least
  B. uncommon
  C. rare
  D. base
  C. rare

• Question 59:

  A threat hunter generates a report containing the list of users who have logged in to a particular database during the last 6 months, along with the number of times they have each authenticated. They sort this list and remove any user names who have logged in more than 6 times. The remaining names represent the users who rarely log in, as their activity is more suspicious. The hunter examines each of these rare logins in detail.

  This is an example of what type of threat-hunting technique?

  A. Least Frequency of Occurrence Analysis
  B. Co-Occurrence Analysis
  C. Time Series Analysis
  D. Outlier Frequency Analysis
  A. Least Frequency of Occurrence Analysis

• Question 60:

  An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the alert are not available. What event disposition should the analyst assign to the Notable Event?

  A. Benign Positive, since there was no evidence that the event actually occurred.
  B. False Negative, since there are no logs to prove the activity actually occurred.
  C. True Positive, since there are no logs to prove that the event did not occur.
  D. Other, since a security engineer needs to ingest the required logs.
  D. Other, since a security engineer needs to ingest the required logs.