Cyber Landscape And Industry Frameworks

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

You are configuring Splunk Enterprise Security to monitor for MITRE ATT&CK 'Persistence' techniques. Which TWO data sources provide the highest fidelity logs for detecting registry-based persistence?

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?