ExamGecko
Login
Home / Splunk / SPLK-5001 / List of questions
Ask Question

Splunk SPLK-5001 Practice Test - Questions Answers, Page 7

Add to Whishlist

List of questions

Question 61

Report Export Collapse

A threat hunter generates a report containing the list of users who have logged in to a particular database during the last 6 months, along with the number of times they have each authenticated. They sort this list and remove any user names who have logged in more than 6 times. The remaining names represent the users who rarely log in, as their activity is more suspicious. The hunter examines each of these rare logins in detail.

This is an example of what type of threat-hunting technique?

Become a Premium Member for full access
  Unlock Premium Member

Question 62

Report Export Collapse

What is the main difference between hypothesis-driven and data-driven Threat Hunting?

Become a Premium Member for full access
  Unlock Premium Member

Question 63

Report Export Collapse

The Security Operations Center (SOC) manager is interested in creating a new dashboard for typosquatting after a successful campaign against a group of senior executives. Which existing ES dashboard could be used as a starting point to create a custom dashboard?

Become a Premium Member for full access
  Unlock Premium Member

Question 64

Report Export Collapse

What is the main difference between a DDoS and a DoS attack?

Become a Premium Member for full access
  Unlock Premium Member

Question 65

Report Export Collapse

An analyst is looking at Web Server logs, and sees the following entry as the last web request that a server processed before unexpectedly shutting down:

147.186.119.107 - - [28/Jul/2006:10:27:10 -0300] 'POST /cgi-bin/shutdown/ HTTP/1.0' 200 3333

What kind of attack is most likely occurring?

Become a Premium Member for full access
  Unlock Premium Member

Question 66

Report Export Collapse

Which of the Enterprise Security frameworks provides additional automatic context and correlation to fields that exist within raw data?

Become a Premium Member for full access
  Unlock Premium Member
Total 66 questions
Go to page: of 7
Open VPLUS File
Convert VPLUS to PDF

Related questions

What is the following step-by-step description an example of? 1. The attacker devises a non-default beacon profile with Cobalt Strike and embeds this within a document. 2. The attacker creates a unique email with the malicious document based on extensive research about their target. 3. When the victim opens this document, a C2 channel is established to the attacker's temporary infrastructure on a compromised website.
Which search command allows an analyst to match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor breakers such as periods or underscores?
Which of the following is a best practice when creating performant searches within Splunk?
Splunk Enterprise Security has numerous frameworks to create correlations, integrate threat intelligence, and provide a workflow for investigations. Which framework raises the threat profile of individuals or assets to allow identification of people or devices that perform an unusual amount of suspicious activities?
Which of the following data sources can be used to discover unusual communication within an organization's network?
An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review. Where would they find this?
An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?
What is the main difference between hypothesis-driven and data-driven Threat Hunting?
The field file_acl contains access controls associated with files affected by an event. In which data model would an analyst find this field?
Which of the following is a correct Splunk search that will return results in the most performant way?