Home / Splunk / SPLK-5001

Splunk SPLK-5001 Practice Test - Questions Answers, Page 3

Question list

List of questions

Question 21

(0)

The following list contains examples of Tactics, Techniques, and Procedures (TTPs): 1. Exploiting a remote service 2. Lateral movement 3. Use EternalBlue to exploit a remote SMB server In which

Question 22

(0)

An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the al

Question 23

(0)

Tactics, Techniques, and Procedures (TTPs) are methods or behaviors utilized by attackers. In which framework are these categorized?

Question 24

(0)

A threat hunter executed a hunt based on the following hypothesis: As an actor, I want to plant rundll32 for proxy execution of malicious code and leverage Cobalt Strike for Command and Control. R

Question 25

(0)

An analyst notices that one of their servers is sending an unusually large amount of traffic, gigabytes more than normal, to a single system on the Internet. There doesn't seem to be any associated

Question 26

(0)

In which phase of the Continuous Monitoring cycle are suggestions and improvements typically made?

Question 27

(0)

An analyst is not sure that all of the potential data sources at her company are being correctly or completely utilized by Splunk and Enterprise Security. Which of the following might she suggest us

Question 28

(0)

During their shift, an analyst receives an alert about an executable being run from C:\Windows\Temp. Why should this be investigated further?

Question 29

(0)

An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review. Where would they find this?

Question 30

(0)

A Risk Rule generates events on Suspicious Cloud Share Activity and regularly contributes to confirmed incidents from Risk Notables. An analyst realizes the raw logs these events are generated from

Question 21

The following list contains examples of Tactics, Techniques, and Procedures (TTPs):

1. Exploiting a remote service

2. Lateral movement

3. Use EternalBlue to exploit a remote SMB server

In which order are they listed below?

Tactic, Technique, Procedure

Procedure, Technique, Tactic

Technique, Tactic, Procedure

Tactic, Procedure, Technique

Show Answer Comment (0)

An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the alert are not available.

What event disposition should the analyst assign to the Notable Event?

Benign Positive, since there was no evidence that the event actually occurred.

False Negative, since there are no logs to prove the activity actually occurred.

True Positive, since there are no logs to prove that the event did not occur.

Other, since a security engineer needs to ingest the required logs.

Show Answer Comment (0)

Question 23

Tactics, Techniques, and Procedures (TTPs) are methods or behaviors utilized by attackers. In which framework are these categorized?

NIST 800-53

ISO 27000

CIS18

MITRE ATT&CK

Show Answer Comment (0)

Question 24

A threat hunter executed a hunt based on the following hypothesis:

As an actor, I want to plant rundll32 for proxy execution of malicious code and leverage Cobalt Strike for Command and Control.

Relevant logs and artifacts such as Sysmon, netflow, IDS alerts, and EDR logs were searched, and the hunter is confident in the conclusion that Cobalt Strike is not present in the company's environment.

Which of the following best describes the outcome of this threat hunt?

The threat hunt was successful because the hypothesis was not proven.

The threat hunt failed because the hypothesis was not proven.

The threat hunt failed because no malicious activity was identified.

The threat hunt was successful in providing strong evidence that the tactic and tool is not present in the environment.

Show Answer Comment (0)

Question 25

An analyst notices that one of their servers is sending an unusually large amount of traffic, gigabytes more than normal, to a single system on the Internet. There doesn't seem to be any associated increase in incoming traffic.

What type of threat actor activity might this represent?

Data exfiltration

Network reconnaissance

Data infiltration

Lateral movement

Show Answer Comment (0)

Question 26

In which phase of the Continuous Monitoring cycle are suggestions and improvements typically made?

Define and Predict

Establish and Architect

Analyze and Report

Implement and Collect

Show Answer Comment (0)

Question 27

An analyst is not sure that all of the potential data sources at her company are being correctly or completely utilized by Splunk and Enterprise Security. Which of the following might she suggest using, in order to perform an analysis of the data types available and some of their potential security uses?

Splunk ITSI

Security Essentials

SOAR

Splunk Intelligence Management

Show Answer Comment (0)

Question 28

During their shift, an analyst receives an alert about an executable being run from C:\Windows\Temp. Why should this be investigated further?

Temp directories aren't owned by any particular user, making it difficult to track the process owner when files are executed.

Temp directories are flagged as non-executable, meaning that no files stored within can be executed, and this executable was run from that directory.

Temp directories contain the system page file and the virtual memory file, meaning the attacker can use their malware to read the in memory values of running programs.

Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions.

Show Answer Comment (0)

Question 29

An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review. Where would they find this?

Running the Risk Analysis Adaptive Response action within the Notable Event.

Via a workflow action for the Risk Investigation dashboard.

Via the Risk Analysis dashboard under the Security Intelligence tab in Enterprise Security.

Clicking the risk event count to open the Risk Event Timeline.

Show Answer Comment (0)