최신 SPLK-5001 무료덤프 - Splunk Certified Cybersecurity Defense Analyst

문제1

A threat hunter executed a hunt based on the following hypothesis:
As an actor, I want to plant rundll32 for proxy execution of malicious code and leverage Cobalt Strike for Command and Control.
Relevant logs and artifacts such as Sysmon, netflow, IDS alerts, and EDR logs were searched, and the hunter is confident in the conclusion that Cobalt Strike is not present in the company's environment.
Which of the following best describes the outcome of this threat hunt?

A. The threat hunt failed because no malicious activity was identified.

B. The threat hunt was successful because the hypothesis was not proven.

C. The threat hunt was successful in providing strong evidence that the tactic and tool is not present in the environment.

D. The threat hunt failed because the hypothesis was not proven.

정답: C

문제2

An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which the attacker is moving would be in which field?

A. host

B. src_nt_host

C. dest

D. src_ip

정답: D

문제3

When searching in Splunk, which of the following SPL commands can be used to run a subsearch across every field in a wildcard field list?

A. rex

B. makeresults

C. foreach

D. transaction

정답: C

문제4

What is the main difference between a DDoS and a DoS attack?

A. A DDoS attack uses a single source to target multiple systems, while a DoS attack uses multiple sources to target a single system.

B. A DDoS attack is a type of physical attack, while a DoS attack is a type of cyberattack.

C. A DDoS attack uses a single source to target a single system, while a DoS attack uses multiple sources to target multiple systems.

D. A DDoS attack uses multiple sources to target a single system, while a DoS attack uses a single source to target a single or multiple systems.

정답: D

문제5

An analyst is not sure that all of the potential data sources at her company are being correctly or completely utilized by Splunk and Enterprise Security. Which of the following might she suggest using, in order to perform an analysis of the data types available and some of their potential security uses?

A. Splunk Intelligence Management

B. Splunk ITSI

C. Security Essentials

D. SOAR

정답: C

문제6

An organization is using Risk-Based Alerting (RBA). During the past few days, a user account generated multiple risk observations. Splunk refers to this account as what type of entity?

A. Risk Index

B. Risk Factor

C. Risk Object

D. Risk Analysis

정답: A

문제7

Tactics, Techniques, and Procedures (TTPs) are methods or behaviors utilized by attackers. In which framework are these categorized?

A. MITRE ATT&CK

B. ISO 27000

C. NIST 800-53

D. CIS18

정답: A

최신 SPLK-5001 무료덤프 - Splunk Certified Cybersecurity Defense Analyst

우리와 연락하기

유용한 링크

최신 업데이트