Free SPLK-5001: Splunk Certified Cybersecurity Defense Analyst Exam Questions and Answers

Which framework provides a prioritized set of safeguards that are grouped into Implementation Groups (IG1, IG2 and IG3) based on an organization's size and risk profile?

• AA. PCI DSS requirements
• BB. NIST Cybersecurity Framework
• CC. CIS Critical Security Controls
• DD. ISO/IEC 27001 Annex A controls

An engineer is configuring a correlation search in Splunk Enterprise Security. Which adaptive response action assigns a risk score to a risk object without creating a notable event?

• AA. Risk Analysis
• BB. Nbtstat
• CC. Notable
• DD. Run a Script

An analyst needs the number of failed logons per source for the last 24 hours. The Authentication data model is accelerated and CIM compliant. Which search returns the results MOST efficiently?

• AA. | datamodel Authentication Authentication search | search Authentication.action=failure | stats count by Authentication.src
• BB. index=wineventlog | search EventCode=4625 | stats count by src
• CC. index=* sourcetype=WinEventLog:Security EventCode=4625 | stats count by src
• DD. | tstats summariesonly=true count from datamodel=Authentication where Authentication.action=failure by Authentication.src

A company is moving its security monitoring from a single on-premises data center to a design that spans several cloud providers and business units. A team member must define the overall monitoring design, choose the tooling and set the data standards the others will follow. Which SOC role typically has this responsibility?

• AA. SOC engineer
• BB. Incident responder
• CC. Tier 1 SOC analyst
• DD. SOC architect

During a review of an intrusion, the SOC records the following timeline: Mar 3, 08:00 - attacker first gains access Mar 9, 08:00 - alert is triaged and the incident is declared Mar 9, 20:00 - affected hosts are contained Which metric does the 12-hour interval between declaration and containment represent?

• AA. Mean time to detect (MTTD)
• BB. Mean time to respond (MTTR)
• CC. Dwell time
• DD. Mean time between failures

A threat hunter takes the file hashes, IP addresses and domain names listed in a recent threat intelligence report and searches endpoint and network data for any matches. Which hunting technique is this?

• AA. Configuration-based hunting
• BB. Behavioral analytics
• CC. Indicator-based hunting
• DD. Anomaly modeling

An analyst wants to find detection searches that map to MITRE ATT&CK technique T1003 (OS Credential Dumping) and see which of them can run against data already ingested in the environment. Which resource should the analyst use?

• AA. The product tips section of Splunk Lantern, filtered by the Security category
• BB. The Search Reference manual in Splunk Docs, using the stats command page
• CC. The Incident Review dashboard in Splunk Enterprise Security, filtered by technique
• DD. The Security Content page in Splunk Security Essentials, filtered by data availability

In the Splunk Enterprise Security risk framework, what does a correlation search with the Risk Analysis adaptive response action write when it matches?

• AA. A notable event that is placed in Incident Review for immediate triage
• BB. An asset record that is added to the asset lookup with a raised priority
• CC. A threat intelligence artifact that is added to the threat collection
• DD. A risk event that adds a risk score to a risk object in the risk index

In a typical SOC, which role is primarily responsible for onboarding new log sources, deploying forwarders and maintaining the parsing and normalization of data in the SIEM?

• AA. SOC Manager
• BB. SOC Engineer
• CC. SOC Analyst
• DD. SOC Architect

Which sourcetype does the Splunk Add-on for Amazon Web Services assign to the record of API calls made in an AWS account?

• AA. aws:config
• BB. aws:cloudtrail
• CC. aws:cloudwatchlogs:vpcflow
• DD. aws:s3:accesslogs