Home / Splunk / SPLK-5001

Question list

List of questions

Question 1

(0)

When searching in Splunk, which of the following SPL commands can be used to run a subsearch across every field in a wildcard field list?

Question 2

(0)

How are Notable Events configured in Splunk Enterprise Security?

Question 3

(0)

An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which

Question 4

(0)

Which of the following is a best practice when creating performant searches within Splunk?

Question 5

(0)

Which pre-packaged app delivers security content and detections on a regular, ongoing basis for Enterprise Security and SOAR?

Question 6

(0)

Which search command allows an analyst to match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor breakers such as

Question 7

(0)

Which field is automatically added to search results when assets are properly defined and enabled in Splunk Enterprise Security?

Question 8

(0)

An IDS signature is designed to detect and alert on logins to a certain server, but only if they occur from 6:00 PM - 6:00 AM. If no IDS alerts occur in this window, but the signature is known to be

Question 9

(0)

Which of the following is not a component of the Splunk Security Content library (ESCU, SSE)?

Question 10

(0)

The eval SPL expression supports many types of functions. Which of these function categories is not valid with eval?

Related questions

A Risk Notable Event has been triggered in Splunk Enterprise Security, an analyst investigates the alert, and determines it is a false positive. What metric would be used to define the time between alert creation and close of the event?

A Risk Rule generates events on Suspicious Cloud Share Activity and regularly contributes to confirmed incidents from Risk Notables. An analyst realizes the raw logs these events are generated from contain information which helps them determine what might be malicious. What should they ask their engineer for to make their analysis easier?

Splunk Enterprise Security has numerous frameworks to create correlations, integrate threat intelligence, and provide a workflow for investigations. Which framework raises the threat profile of individuals or assets to allow identification of people or devices that perform an unusual amount of suspicious activities?

When threat hunting for outliers in Splunk, which of the following SPL pipelines would filter for users with over a thousand occurrences?

What is the following step-by-step description an example of? 1. The attacker devises a non-default beacon profile with Cobalt Strike and embeds this within a document. 2. The attacker creates a unique email with the malicious document based on extensive research about their target. 3. When the victim opens this document, a C2 channel is established to the attacker's temporary infrastructure on a compromised website.

After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in another field called machine_name. What SPL could they use to find all relevant events across either field until the field extraction is fixed?

An analyst is examining the logs for a web application's login form. They see thousands of failed logon attempts using various usernames and passwords. Internet research indicates that these credentials may have been compiled by combining account information from several recent data breaches. Which type of attack would this be an example of?

Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server's access log has the same log entry millions of times: 147.186.119.200 - - [28/Jul/2023:12:04:13 -0300] 'GET /login/ HTTP/1.0' 200 3733 What kind of attack is occurring?

The following list contains examples of Tactics, Techniques, and Procedures (TTPs): 1. Exploiting a remote service 2. Lateral movement 3. Use EternalBlue to exploit a remote SMB server In which order are they listed below?

According to Splunk CIM documentation, which field in the Authentication Data Model represents the user who initiated a privilege escalation?

Question 52 - SPLK-5001 discussion

An analysis of an organization's security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of implementing the new process or solution that was selected?