2024年10月本日更新されたSPLK-5001試験問題集PDF試験エンジン無料！ [Q14-Q35]

質問14、 A threat hunter generates a report containing the list of users who have logged in to a particular database during the last 6 months, along with the number of times they have each authenticated. They sort this list and remove any user names who have logged in more than 6 times. The remaining names represent the users who rarely log in, as their activity is more suspicious. The hunter examines each of these rare logins in detail.
This is an example of what type of threat-hunting technique?

質問15、 What is the main difference between a DDoS and a DoS attack?

質問16、 Which of the following is the primary benefit of using the CIM in Splunk?

質問17、 An IDS signature is designed to detect and alert on logins to a certain server, but only if they occur from 6:00 PM – 6:00 AM. If no IDS alerts occur in this window, but the signature is known to be correct, this would be an example of what?

質問18、 The field file_acl contains access controls associated with files affected by an event. In which data model would an analyst find this field?

質問19、 A threat hunter executed a hunt based on the following hypothesis:
As an actor, I want to plant rundll32 for proxy execution of malicious code and leverage Cobalt Strike for Command and Control.
Relevant logs and artifacts such as Sysmon, netflow, IDS alerts, and EDR logs were searched, and the hunter is confident in the conclusion that Cobalt Strike is not present in the company’s environment.
Which of the following best describes the outcome of this threat hunt?

質問20、 An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which the attacker is moving would be in which field?

質問21、 According to Splunk CIM documentation, which field in the Authentication Data Model represents the user who initiated a privilege escalation?

質問22、 Which of the Enterprise Security frameworks provides additional automatic context and correlation to fields that exist within raw data?

質問23、 According to David Bianco’s Pyramid of Pain, which indicator type is least effective when used in continuous monitoring?

質問24、 There are many resources for assisting with SPL and configuration questions. Which of the following resources feature community-sourced answers?

質問25、 Which of the following is not a component of the Splunk Security Content library (ESCU, SSE)?

質問26、 In which phase of the Continuous Monitoring cycle are suggestions and improvements typically made?

質問27、 A Risk Notable Event has been triggered in Splunk Enterprise Security, an analyst investigates the alert, and determines it is a false positive. What metric would be used to define the time between alert creation and close of the event?

質問28、 Which of the following Splunk Enterprise Security features allows industry frameworks such as CIS Critical Security Controls, MITRE ATT&CK, and the Lockheed Martin Cyber Kill Chain to be mapped to Correlation Search results?

質問29、 Splunk Enterprise Security has numerous frameworks to create correlations, integrate threat intelligence, and provide a workflow for investigations. Which framework raises the threat profile of individuals or assets to allow identification of people or devices that perform an unusual amount of suspicious activities?

質問30、 While the top command is utilized to find the most common values contained within a field, a Cyber Defense Analyst hunts for anomalies. Which of the following Splunk commands returns the least common values?

質問31、 Which of the following is a correct Splunk search that will return results in the most performant way?

質問32、 An analyst notices that one of their servers is sending an unusually large amount of traffic, gigabytes more than normal, to a single system on the Internet. There doesn’t seem to be any associated increase in incoming traffic.
What type of threat actor activity might this represent?

質問33、 A successful Continuous Monitoring initiative involves the entire organization. When an analyst discovers the need for more context or additional information, perhaps from additional data sources or altered correlation rules, to what role would this request generally escalate?

質問34、 The following list contains examples of Tactics, Techniques, and Procedures (TTPs):
1. Exploiting a remote service
2. Lateral movement
3. Use EternalBlue to exploit a remote SMB server
In which order are they listed below?

質問35、 Which Enterprise Security framework provides a mechanism for running preconfigured actions within the Splunk platform or integrating with external applications?