Nest 0 Cart
Nest Account
Popular Exams
All Categories...
Nest
Nest 0
Contact
Log In / Sign Up
Copyright 2024 © store. All rights reserved.
Home Splunk® SPLK-5002

Splunk® SPLK-5002 Exam Practice Questions (P. 1)

  • Full Access (91 questions)
  • One Year of Premium Access
  • Access to one million comments
  • Seamless ChatGPT Integration
  • Ability to download PDF files
  • Anki Flashcard files for revision
  • No Captcha & No AdSense
  • Advanced Exam Configuration
Get Contributor Access
Question #1
Which of the following is a reason to utilize ES risk framework as a part of detection building?
  1. A
    Create a feedback loop into threat intelligence to identify potential insider threats.
  2. B
    Help accelerate the run time of detections, allowing a faster mean time to detection.
  3. C
    Simplify SOAR automation and remediation, lowering the mean time to recover.
  4. D
    Help prioritize security findings based on their potential business impact.

Correct Answer: D ?️

Question #2
When creating a case in Splunk SOAR, which action should be taken to correlate various findings (risk notables) to ensure all are actioned?
  1. A
    Search Splunk Enterprise Security for similar or duplicate events based on the threat_object field in a risk notable.
  2. B
    Search Splunk Enterprise Security for all related events based on key fields in a notable and select how to process the results to decide which events to merge into the current investigation.
  3. C
    Search Splunk Enterprise Security for similar or duplicate events based on the risk_object field in a risk notable.
  4. D
    Search Splunk Enterprise Security for all related events based on key fields in a risk notable and select how to process the results to decide which events to merge into the current investigation.

Correct Answer: D ?️

Question #3
Consider the following series of events:
4:00 GMT Detection runs for interval 3:30-4:00
4:30 GMT Detection runs for interval 4:00-4:30
4:35 GMT Event 1 occurs on an endpoint
4:45 GMT Event 1 is indexed
5:00 GMT Detection runs for interval 4:30-5:00
5:05 GMT Event 1 finding is added to ES with timestamp 4:35
5:24 GMT Event 2 occurs on an endpoint
5:30 GMT Detection runs for interval 5:00-5:30
5:35 GMT Event 2 is indexed
6:00 GMT Detection runs for interval 5:30-6:00
What is the problem with the detection schedule chosen and how can it be solved?
  1. A
    The time window for the detection is too large, causing duplicate alerts.
  2. B
    The logs are delayed so the detection time window needs to be increased.
  3. C
    The time window for the detection is too small, causing duplicate alerts.
  4. D
    The logs are delayed so the detection time window needs to be decreased.

Correct Answer: B ?️

Question #4
An effective method for building automation workflows is to follow the OODA (Observe, Orient, Decide, Act) loop stages. When transitioning between the Decide and Act stages, what additional work should be included before automating the Act stage?
  1. A
    Create a new response template.
  2. B
    Validate if the asset, identity, or service has an exemption.
  3. C
    Validate response data paths from Decide stage.
  4. D
    Create a new automation playbook.

Correct Answer: B ?️

Question #5
What is the best method to operationalize the results of a threat hunt for daily use by SOC analysts?
  1. A
    Communicate findings based on the hunt.
  2. B
    Create monthly reports based on the documented findings.
  3. C
    Create detections based on the documented findings.
  4. D
    Communicate gaps to the architecture team.

Correct Answer: C ?️

Next Questions

All Pages