Splunk SPLK-5001 Online Practice Questions and Exam Preparation

Splunk SPLK-5001 Online Questions & Answers

• Question 61:

  According to David Bianco's Pyramid of Pain, which indicator type is least effective when used in continuous monitoring?

  A. Domain names
  B. TTPs
  C. NetworM-lost artifacts
  D. Hash values
  D. Hash values

• Question 62:

  What is the main difference between a DDoS and a DoS attack?

  A. A DDoS attack is a type of physical attack, while a DoS attack is a type of cyberattack.
  B. A DDoS attack uses a single source to target a single system, while a DoS attack uses multiple sources to target multiple systems.
  C. A DDoS attack uses multiple sources to target a single system, while a DoS attack uses a single source to target a single or multiple systems.
  D. A DDoS attack uses a single source to target multiple systems, while a DoS attack uses multiple sources to target a single system.
  C. A DDoS attack uses multiple sources to target a single system, while a DoS attack uses a single source to target a single or multiple systems.

• Question 63:

  An analyst is not sure that all of the potential data sources at her company are being correctly or completely utilized by Splunk and Enterprise Security. Which of the following might she suggest using, in order to perform an analysis of the data types available and some of their potential security uses?

  A. Splunk ITSI
  B. Security Essentials
  C. SOAR
  D. Splunk Intelligence Management
  B. Security Essentials

• Question 64:

  An analyst notices that one of their servers is sending an unusually large amount of traffic, gigabytes more than normal, to a single system on the Internet. There doesn't seem to be any associated increase in incoming traffic. What type of threat actor activity might this represent?

  A. Data exfiltration
  B. Network reconnaissance
  C. Data infiltration
  D. Lateral movement
  A. Data exfiltration

• Question 65:

  What is the following step-by-step description an example of?

  1.The attacker devises a non-default beacon profile with Cobalt Strike and embeds this within a document.

  2.The attacker creates a unique email with the malicious document based on extensive research about their target.

  3.When the victim opens this document, a C2 channel is established to the attacker's temporary infrastructure on a compromised website.

  A. Tactic
  B. Policy
  C. Procedure
  D. Technique
  D. Technique

• Question 66:

  An analyst needs to create a new field at search time. Which Splunk command will dynamically extract additional fields as part of a Search pipeline?

  A. rex
  B. fields
  C. regex
  D. eval
  A. rex