Splunk SPLK-5001 問題集

質問 1：
An analyst investigates an IDS alert and confirms suspicious traffic to a known malicious IP. What Enterprise Security data model would they use to investigate which process initiated the network connection?
A. Endpoint
B. Authentication
C. Network traffic
D. Web
正解：A

質問 2：
An analyst is investigating how an attacker successfully performs a brute-force attack to gain a foothold into an organizations systems. In the course of the investigation the analyst determines that the reason no alerts were generated is because the detection searches were configured to run against Windows data only and excluding any Linux data.
This is an example of what?
A. A True Positive.
B. A True Negative.
C. A False Negative.
D. A False Positive.
正解：C

質問 3：
Which of the following data sources can be used to discover unusual communication within an organization's network?
A. Email
B. EDS
C. IAM
D. Net Flow
正解：D

質問 4：
The Security Operations Center (SOC) manager is interested in creating a new dashboard for typosquatting after a successful campaign against a group of senior executives. Which existing ES dashboard could be used as a starting point to create a custom dashboard?
A. Access Anomalies
B. Malware Center
C. IAM Activity
D. New Domain Analysis
正解：D

質問 5：
A threat hunter executed a hunt based on the following hypothesis:
As an actor, I want to plant rundll32 for proxy execution of malicious code and leverage Cobalt Strike for Command and Control.
Relevant logs and artifacts such as Sysmon, netflow, IDS alerts, and EDR logs were searched, and the hunter is confident in the conclusion that Cobalt Strike is not present in the company's environment.
Which of the following best describes the outcome of this threat hunt?
A. The threat hunt was successful in providing strong evidence that the tactic and tool is not present in the environment.
B. The threat hunt was successful because the hypothesis was not proven.
C. The threat hunt failed because no malicious activity was identified.
D. The threat hunt failed because the hypothesis was not proven.
正解：A

質問 6：
What is the main difference between a DDoS and a DoS attack?
A. A DDoS attack uses a single source to target multiple systems, while a DoS attack uses multiple sources to target a single system.
B. A DDoS attack uses a single source to target a single system, while a DoS attack uses multiple sources to target multiple systems.
C. A DDoS attack is a type of physical attack, while a DoS attack is a type of cyberattack.
D. A DDoS attack uses multiple sources to target a single system, while a DoS attack uses a single source to target a single or multiple systems.
正解：D

質問 7：
An organization is using Risk-Based Alerting (RBA). During the past few days, a user account generated multiple risk observations. Splunk refers to this account as what type of entity?
A. Risk Object
B. Risk Analysis
C. Risk Factor
D. Risk Index
正解：D