SPLK-5001 Cyber Landscape And Industry Frameworks — 15 Questions

Question 1

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

Accepted Answer

Command and Control (C2).. Egress filtering prevents infected hosts from communicating with external Command and Control (C2) servers.

Answer

Installation.

Answer

Reconnaissance.

Answer

Exploitation.

Question 2

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

Accepted Answer

tstats count from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe.. The 'tstats' command is the standard way to query data models efficiently, such as the 'Endpoint' model, to look for malicious PowerShell patterns.

Answer

search sourcetype=sysmon | rename command as powershell.

Answer

| inputlookup mitre_tactics | where process=powershell.

Answer

index=main | lookup mitre_attack_id.

Question 3

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Accepted Answer

Email gateway logs and web proxy logs.. The Delivery phase involves getting the malicious payload to the target, typically via email, web, or file transfer.

Answer

Domain Controller authentication logs.

Answer

Internal host process creation logs.

Answer

Endpoint file integrity monitoring.

Question 4

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

Accepted Answer

Navigate to the 'Compliance' tab and run a report on 'Framework Coverage'.. The 'Content Introspection' or 'Security Content' dashboard in SSE allows users to filter by framework and maturity to identify coverage gaps.

Answer

Manually edit the 'Data Model' accelerations for NIST compliance.

Answer

Modify the 'Notable Event' aggregation policy to NIST standards.

Answer

Update the 'Threat Intelligence' index settings to include NIST tags.

Question 5

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

Accepted Answer

Assets and Identity Data Model.. The 'Inventory' data model (part of the Common Information Model) is the foundation for asset tracking in Splunk ES.

Answer

Vulnerability Data Model.

Answer

Endpoint Data Model.

Answer

Network Traffic Data Model.

Question 6

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

Accepted Answer

Splunk App for CIS Benchmarks.. Splunk Add-on for CIS (or specifically the Splunk App for CIS Benchmarks) is the designated tool for importing and visualizing these audits.

Answer

Splunk Add-on for Linux Auditd.

Answer

Splunk App for Infrastructure (SAI).

Answer

Splunk Enterprise Security Vulnerability Scanner.

Question 7

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

Accepted Answer

Utilizing the 'mitre_attack_id' field within the Threat Intelligence framework.. The MITRE ATT&CK mapping in ES relies on the 'mitre_attack_id' field within the threat intelligence framework to correlate events with the enterprise matrix.

Answer

Hardcoding the technique description into the 'dest_host' field.

Answer

Configuring the 'correlation_rule_id' to match the ATT&CK tactic name.

Answer

Mapping the source IP to the 'mitre_source_id' field.

Question 8

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

Accepted Answer

A KV Store collection configured via the 'Threat Intelligence Manager'.. The Threat Intelligence framework in ES supports importing custom feeds via CSV or KV Store lookups formatted as threat intel objects, often mapped to MITRE via STIX/TAXII integrations.

Answer

An XML-based 'Incident Review' dashboard export.

Answer

A custom .yml file uploaded to the /etc/system/local directory.

Answer

A static .conf file in the app bin folder.

Question 9

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

Accepted Answer

Executing code to take advantage of a vulnerability.. The Exploitation phase involves the attacker taking advantage of a vulnerability to gain access to the system.

Answer

Establishing a persistent connection to the attacker.

Answer

Exfiltrating sensitive company data.

Answer

Gathering information about the target.

Question 10

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

Accepted Answer

Email security logs or Web Proxy logs.. Initial Access often occurs via phishing or exploited public-facing applications, making web or email logs primary investigation targets.

Answer

Local authentication logs.

Answer

Process audit logs.

Answer

Registry modification logs.

Question 11

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

Accepted Answer

The 'Incident Review' dashboard for documenting resolution steps.. The 'Incident Review' dashboard and the 'Notable Event' workflow actions allow for the documentation and categorization of incident resolution and recovery steps.

Answer

The 'Data Model Acceleration' settings.

Answer

The 'Threat Intelligence' upload manager.

Answer

The 'Workflow Actions' settings for firewall rule creation.

Question 12

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

Accepted Answer

The 'Authentication' Data Model.. The 'Authentication' data model is critical for tracking account usage, which is the primary method for lateral movement.

Answer

The 'Network Resolution' Data Model.

Answer

The 'Vulnerability' Data Model.

Answer

The 'Malware' Data Model.

Question 13

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Accepted Answer

Asset and Identity framework using lookup tables.. The 'Asset and Identity' framework in ES allows for the ingestion of authoritative lists of software and assets for comparison against endpoint logs.

Answer

Index-time field extraction.

Answer

Correlation search thresholding.

Answer

Dynamic Threat Intelligence updates.

Question 14

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Accepted Answer

Scanning external IP ranges for open ports.. Reconnaissance involves active or passive research performed by an attacker to gather information on a target's infrastructure.

Answer

Sending a spear-phishing email.

Answer

Encrypting user files for ransom.

Answer

Installing a backdoor on a web server.

Question 15

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

Accepted Answer

Detect. The five core functions of NIST CSF are Identify, Protect, Detect, Respond, and Recover.

Answer

Report

Answer

Eradicate