Splunk SPLK-5001 問題集

質問 1：
An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which the attacker is moving would be in which field?
A. dest
B. src_nt_host
C. host
D. src_ip
正解：D

質問 2：
What is the following step-by-step description an example of?
1. The attacker devises a non-default beacon profile with Cobalt Strike and embeds this within a document.
2. The attacker creates a unique email with the malicious document based on extensive research about their target.
3. When the victim opens this document, a C2 channel is established to the attacker's temporary infrastructure on a compromised website.
A. Technique
B. Procedure
C. Policy
D. Tactic
正解：A

質問 3：
Which of the following is not considered an Indicator of Compromise (IOC)?
A. A specific file hash of a malicious executable.
B. A specific password for a compromised account.
C. A specific domain that is utilized for phishing.
D. A specific IP address used in a cyberattack.
正解：B

質問 4：
According to David Bianco's Pyramid of Pain, which indicator type is least effective when used in continuous monitoring?
A. Domain names
B. TTPs
C. Hash values
D. NetworM-lost artifacts
正解：C

質問 5：
An analyst is examining the logs for a web application's login form. They see thousands of failed logon attempts using various usernames and passwords. Internet research indicates that these credentials may have been compiled by combining account information from several recent data breaches.
Which type of attack would this be an example of?
A. Password spraying
B. Credential sniffing
C. Password cracking
D. Credential stuffing
正解：D

質問 6：
The Lockheed Martin Cyber Kill Chain breaks an attack lifecycle into several stages. A threat actor modified the registry on a compromised Windows system to ensure that their malware would automatically run at boot time. Into which phase of the Kill Chain would this fall?
A. Installation
B. Exploitation
C. Act on Objectives
D. Delivery
正解：A

質問 7：
After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in another field called machine_name.
What SPL could they use to find all relevant events across either field until the field extraction is fixed?
A. | eval src = coalesce(src,machine_name)
B. | eval src = tostring(machine_name)
C. | eval src = src . machine_name
D. | eval src = src + machine_name
正解：A