Threat And Attack Types

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?

You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?

You need to correlate a VPN login with a subsequent file access on an internal server. Which Splunk ES feature helps you link these disparate events?

An attacker has modified the registry to ensure persistence. Which Splunk ES data model tracks Windows registry changes?

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?

A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

Which THREE of the following data models are critical for monitoring lateral movement within a network?

Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?

Which THREE of the following are common indicators that a host has been infected with malware?

Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?

Which TWO of the following are common types of social engineering?

Which TWO of the following are examples of reconnaissance techniques used by attackers?

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

Which THREE of the following data sources are most valuable for detecting an insider threat?

Which THREE of the following fields are required for mapping data to the 'Authentication' CIM data model?

Which THREE of the following components are part of the 'Endpoint' data model?

Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?