An analyst is building a search to examine Windows XML Event Logs, but the initial search is not returning any extracted fields. Based on the above image, what is the most likely cause?

The analyst did not add the excract command to their search pipeline.

The analyst does not have the proper role to search this data.

The analyst is searching newly indexed data that was improperly parsed.

The analyst did not add the excract command to their search pipeline.

The analyst is not in the Drooer Search Mode and should switch to Smart or Verbose.

Which of the following is a best practice for searching in Splunk?

Limit fields returned from the search utilizing the cable command.

Streaming commands run before aggregating commands in the Search pipeline.

Raw word searches should contain multiple wildcards to ensure all edge cases are covered.

Limit fields returned from the search utilizing the cable command.

Searching over All Time ensures that all relevant data is returned.

After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in another field called machine_name.What SPL could they use to find all relevant events across either field until the field extraction is fixed?

| eval src = coalesce(src,machine_name)

| eval src = src + machine_name

| eval src = src . machine_name

| eval src = tostring(machine_name)

Which of the following is a correct Splunk search that will return results in the most performant way?

index=foo host=i-478619733 | stats range(_time) as duration by src_ip | bin duration span=5min | stats count by duration, host

| stats range(_time) as duration by src_ip | index=foo host=i-478619733 | bin duration span=5min | stats count by duration, host

index=foo host=i-478619733 | transaction src_ip |stats count by host

index=foo | transaction src_ip |stats count by host | search host=i-478619733

Which of the following is a tactic used by attackers, rather than a technique?

Gathering information about a target.

Establishing persistence with a scheduled task.

Using a phishing email to gain initial access.

Escalating privileges via UAC bypass.

A threat hunter generates a report containing the list of users who have logged in to a particular database during the last 6 months, along with the number of times they have each authenticated. They sort this list and remove any user names who have logged in more than 6 times. The remaining names represent the users who rarely log in, as their activity is more suspicious. The hunter examines each of these rare logins in detail.This is an example of what type of threat-hunting technique?

Least Frequency of Occurrence Analysis

What is the main difference between hypothesis-driven and data-driven Threat Hunting?

Data-driven hunting tries to uncover activity within an existing data set, hypothesis-driven hunting begins with a potential activity that the hunter thinks may be happening.

Data-driven hunts always require more data to search through than hypothesis-driven hunts.

Data-driven hunting tries to uncover activity within an existing data set, hypothesis-driven hunting begins with a potential activity that the hunter thinks may be happening.

Hypothesis-driven hunts are typically executed on newly ingested data sources, while data-driven hunts are not.

Hypothesis-driven hunting tries to uncover activity within an existing data set, data-driven hunting begins with an activity that the hunter thinks may be happening.

What is the main difference between a DDoS and a DoS attack?

A DDoS attack uses multiple sources to target a single system, while a DoS attack uses a single source to target a single or multiple systems.

A DDoS attack is a type of physical attack, while a DoS attack is a type of cyberattack.

A DDoS attack uses a single source to target a single system, while a DoS attack uses multiple sources to target multiple systems.

A DDoS attack uses multiple sources to target a single system, while a DoS attack uses a single source to target a single or multiple systems.

A DDoS attack uses a single source to target multiple systems, while a DoS attack uses multiple sources to target a single system.

An analyst is looking at Web Server logs, and sees the following entry as the last web request that a server processed before unexpectedly shutting down:147.186.119.107 - - [28/Jul/2006:10:27:10 -0300] 'POST /cgi-bin/shutdown/ HTTP/1.0' 200 3333What kind of attack is most likely occurring?

Distributed denial of service attack.

Splunk SPLK-5001 Practice Test 2 - Free Online Exam Prep & Questions

A Cyber Threat Intelligence (CTI) team produces a report detailing a specific threat actor's typical behaviors and intent. This would be an example of what type of intelligence?

Become a Premium Member for full access

Unlock Premium Member

Splunk SPLK-5001 Practice Test 2

Question

Splunk SPLK-5001 Practice Tests

Practice Tests