SPLK-5001: Splunk Certified Cybersecurity Defense Analyst

Which search command allows an analyst to match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor breakers such as periods or underscores?

Which of the following is a best practice when creating performant searches within Splunk?

Splunk Enterprise Security has numerous frameworks to create correlations, integrate threat intelligence, and provide a workflow for investigations. Which framework raises the threat profile of individuals or assets to allow identification of people or devices that perform an unusual amount of suspicious activities?

Which of the following data sources can be used to discover unusual communication within an organization's network?

An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review. Where would they find this?

An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?

What is the main difference between hypothesis-driven and data-driven Threat Hunting?

The field file_acl contains access controls associated with files affected by an event. In which data model would an analyst find this field?

Which of the following is a correct Splunk search that will return results in the most performant way?