SPLK-5001 Cyber Landscape And Industry Frameworks — All Questions With Answers

Question 1

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

Accepted Answer

tstats count from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe.. The `tstats` command efficiently queries data models, and the Endpoint.Processes data model contains process execution events. Filtering for `process_name=powershell.exe` identifies PowerShell usage. To detect obfuscation, additional analysis of command-line arguments is needed, but this search provides the base events for such analysis. It is the most efficient and accurate starting point.

Answer

search sourcetype=sysmon | rename command as powershell.

Answer

| inputlookup mitre_tactics | where process=powershell.

Answer

index=main | lookup mitre_attack_id.

Question 2

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

Accepted Answer

Navigate to the 'Compliance' tab and run a report on 'Framework Coverage'.. Splunk Security Essentials (SSE) includes a Compliance tab that maps its detection content to frameworks like NIST CSF, CIS, and MITRE ATT&CK, and the Framework Coverage report shows which controls are covered and which have gaps. Running this report lets you prioritize detection development against the most critical uncovered controls. This is the intended workflow for aligning SSE content with NIST CSF.

Answer

Manually edit the 'Data Model' accelerations for NIST compliance.

Answer

Modify the 'Notable Event' aggregation policy to NIST standards.

Answer

Update the 'Threat Intelligence' index settings to include NIST tags.

Question 3

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

Accepted Answer

Utilizing the 'mitre_attack_id' field within the Threat Intelligence framework.. Splunk Enterprise Security maps notables to MITRE ATT&CK using the mitre_attack_id field, which is populated through the Threat Intelligence framework and the ES Threat Activity data model. This field carries the technique ID (e.g., T1059) that links a notable event to the correct adversary technique in the ATT&CK matrix, ensuring the Incident Review dashboard reflects actual TTPs.

Answer

Hardcoding the technique description into the 'dest_host' field.

Answer

Configuring the 'correlation_rule_id' to match the ATT&CK tactic name.

Answer

Mapping the source IP to the 'mitre_source_id' field.

Question 4

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

Accepted Answer

A KV Store collection configured via the 'Threat Intelligence Manager'.. The Splunk Enterprise Security Threat Intelligence framework uses a KV Store collection to store and manage threat intelligence data, including custom STIX/TAXII feeds. The Threat Intelligence Manager is the UI component that allows analysts to upload, configure, and maintain these feeds, which are then stored in the KV Store for correlation and enrichment. This approach enables dynamic updates and integration with the MITRE ATT&CK framework through the Threat Intelligence framework's data models and lookups.

Answer

An XML-based 'Incident Review' dashboard export.

Answer

A custom .yml file uploaded to the /etc/system/local directory.

Answer

A static .conf file in the app bin folder.

Question 5

You are configuring Splunk Enterprise Security to monitor for MITRE ATT&CK 'Persistence' techniques. Which TWO data sources provide the highest fidelity logs for detecting registry-based persistence?

Accepted Answer

Sysmon Event IDs 12 and 13.. Sysmon Event IDs 12 and 13 are correct because Event ID 12 logs registry key create/delete operations and Event ID 13 logs registry value set operations, which directly capture the registry modifications attackers use for persistence (e.g., Run keys, Services, IFEO). Windows Registry audit logs (via GPO/Sysmon) are also correct because enabling registry auditing through GPO or Sysmon provides granular, high-fidelity visibility into registry key and value changes tied to persistence mechanisms. Together these sources record the exact registry artifacts (key paths, value names, data, and process context) needed to detect and investigate registry-based persistence. Windows Security Event Logs (4688) only record process creation and lack registry modification detail, so they are insufficient alone. DNS query logs and Netflow logs capture network activity, not local registry changes, and therefore have no fidelity for registry-based persistence detection.

Answer

Windows Security Event Logs (specifically 4688).

Answer

DNS query logs.

Answer

Netflow logs.

Question 6

You are a SOC analyst at a healthcare provider that must satisfy HIPAA breach-notification timelines. During an investigation in Splunk Enterprise Security, you need to determine the elapsed time between the first suspicious authentication event and the moment the incident was classified as a confirmed breach. Which Splunk ES field should you rely on to calculate that elapsed time accurately?

Accepted Answer

The `detect_time` of the notable event compared with the timestamp recorded when the analyst set the disposition to a breach-confirming value.. HIPAA breach clocks depend on when an incident is confirmed as reportable, so the measurement must anchor on a human confirmation action. The notable event's detection timestamp marks when the system flagged activity, and the disposition change records the analyst's confirming decision. Together they produce an auditable elapsed interval. Fields tied to ticket closure, aggregation windows, or default statuses describe other lifecycle moments and cannot represent confirmation time.

Answer

The `_time` value of the notable event's initial triggering event combined with the `status` field transition to "Closed" on the investigation timeline.

Answer

The `create_time` of the investigation record and the `status` field value "New" on the notable event.

Answer

The `firstTime` and `lastTime` fields on the correlated notable event in the Incident Review dashboard.

Question 7

A security analyst is reviewing an alert generated by Splunk Enterprise Security. The alert details indicate that a user's workstation executed a suspicious PowerShell script shortly after opening a malicious document. The analyst wants to determine the next likely phase of the attack according to the Lockheed Martin Cyber Kill Chain. Which phase should the analyst focus on investigating next?

Accepted Answer

Installation. The scenario describes the execution of a PowerShell script after a user opened a malicious document, which is a classic indicator of the Installation phase in the Cyber Kill Chain. During Installation, attackers install malware or backdoors to maintain persistence. This phase follows Exploitation and precedes Command and Control. The analyst should focus on detecting installation activities, such as new services, scheduled tasks, or registry modifications, to contain the threat.

Answer

Weaponization

Answer

Actions on Objectives

Answer

Command and Control

Question 8

A Splunk ES analyst is mapping detection use cases to the Cyber Kill Chain. They want to prioritize data sources for detecting the 'Command and Control' phase. Which data source is most critical for identifying C2 communications?

Accepted Answer

Proxy logs. Proxy logs are the most critical data source for detecting Command and Control communications because they capture web traffic details such as URLs, user agents, and request patterns. C2 often uses HTTP/HTTPS to blend in, and proxy logs can reveal beaconing, unusual user agents, and connections to known malicious domains. While firewall, endpoint, and DNS logs provide valuable context, proxy logs offer the richest application-layer visibility.

Answer

DNS logs

Answer

Endpoint logs

Answer

Firewall logs

Question 9

A Splunk ES analyst is investigating an alert for suspicious PowerShell execution. The alert is mapped to MITRE ATT&CK technique T1059.001. The analyst wants to quickly determine if the PowerShell command line contains encoded commands, which are often used by attackers to obfuscate malicious scripts. Which Splunk search command should the analyst use to extract and decode the Base64-encoded command from the `CommandLine` field?

Accepted Answer

base64decode. To decode a Base64-encoded PowerShell command, the analyst should use the `base64decode` function within an `eval` command. This function is specifically designed to decode Base64 strings. The analyst would first extract the encoded portion using `rex` or similar, then apply `base64decode` to reveal the original command. This approach efficiently uncovers obfuscated malicious scripts, aiding in incident investigation.

Answer

rex

Answer

eval

Answer

urldecode

Question 10

A security analyst is mapping Splunk ES detections to the Cyber Kill Chain. The analyst has an alert for a suspicious email attachment that executed a malicious macro. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Installation. The execution of a malicious macro after delivery and user interaction represents the Installation phase of the Cyber Kill Chain, as it often results in the installation of malware or a backdoor. This phase is critical because it establishes the attacker's presence on the system. Splunk ES can detect this through endpoint logs showing process creation, file writes, or registry modifications associated with macro execution.

Answer

Command and Control

Answer

Exploitation

Answer

Delivery

Question 11

An analyst is using Splunk Enterprise Security to investigate a security incident and wants to leverage the Cyber Kill Chain framework to understand the adversary's progression. The analyst needs to identify which data sources are most relevant for detecting the 'Weaponization' and 'Delivery' phases. (Choose two.)

Accepted Answer

Email gateway logs. Email gateway logs and web proxy logs are the most relevant data sources for detecting the Delivery phase, as they capture the methods by which malicious payloads reach the target, such as phishing emails and drive-by downloads. The Weaponization phase occurs on the adversary's infrastructure and is not directly observable in most enterprise logs, so detection focuses on Delivery. These two sources provide visibility into the initial attack vector.

Answer

Firewall logs

Answer

Endpoint detection and response (EDR) logs

Answer

DNS logs

Question 12

A security analyst is using Splunk Enterprise Security to investigate an alert mapped to the MITRE ATT&CK technique 'T1071 Application Layer Protocol'. Which TWO data sources would provide the most relevant evidence for this technique? (Choose two.)

Accepted Answer

Web proxy logs. Web proxy logs and endpoint process execution logs are the most relevant data sources for T1071 Application Layer Protocol. Proxy logs reveal the actual application layer communications, while endpoint logs show the processes initiating those connections. Together, they provide a comprehensive view of C2 activity using protocols like HTTP or HTTPS.

Answer

Authentication logs

Answer

Firewall logs

Answer

DNS query logs

Question 13

You are an analyst at a financial institution using Splunk Enterprise Security (ES). Your organization is aligning its threat intelligence program with the MITRE ATT&CK framework. You want to leverage Splunk ES's Threat Intelligence framework to enrich events and detect adversary techniques. Which TWO of the following actions are necessary to effectively map threat intelligence to MITRE ATT&CK techniques within Splunk ES? (Choose two.)

Accepted Answer

Configure the Threat Intelligence framework to ingest STIX/TAXII feeds and map indicators to MITRE ATT&CK technique IDs using the threat intelligence management interface.. To effectively map threat intelligence to MITRE ATT&CK in Splunk ES, you must ingest and map indicators to techniques using the Threat Intelligence framework, and enable the relevant correlation search that leverages those mappings to generate notable events. These two actions ensure that threat intel is not only collected but actively used to detect adversary techniques, aligning with ATT&CK for enhanced detection and response.

Answer

Use the 'threat_intel' macro in correlation searches to automatically enrich events with ATT&CK technique context from the threat intelligence framework.

Answer

Deploy the Splunk Add-on for MITRE ATT&CK to automatically tag all events with technique IDs based on keyword matching.

Answer

Create a custom lookup file that maps every possible ATT&CK technique to a Splunk ES correlation search name and manually update it daily.

Question 14

An analyst is investigating a security incident and needs to determine the adversary's objective based on the MITRE ATT&CK tactic 'Exfiltration'. The analyst has Splunk ES with data from multiple sources. Which of the following data sources would be most useful for detecting data exfiltration over a command and control channel (T1041)?

Accepted Answer

Web proxy logs with full URL and content inspection. T1041 involves exfiltrating data over an existing command and control channel, which is often web-based. Web proxy logs with full URL and content inspection provide the deepest visibility into the actual data being transmitted, allowing analysts to detect and confirm exfiltration. This makes them the most effective data source for this technique in Splunk ES.

Answer

Endpoint detection and response (EDR) process telemetry

Answer

NetFlow data and firewall logs

Answer

DNS logs with query logging

Question 15

A security analyst is investigating a potential data exfiltration incident. They have identified a series of outbound connections to an unknown external IP address from a server that typically only communicates internally. The analyst wants to determine if this activity aligns with a specific stage of the Cyber Kill Chain. Which stage is most likely represented by these outbound connections?

Accepted Answer

Actions on Objectives. The Cyber Kill Chain's final stage, Actions on Objectives, encompasses the adversary's goals, including data exfiltration. The unexpected outbound connections from a server that typically communicates internally suggest data is being sent externally, aligning with exfiltration as an objective. While Exfiltration is a specific action, it is not a separate stage in the Cyber Kill Chain; it falls under Actions on Objectives.

Answer

Command and Control (C2)

Answer

Exfiltration

Answer

Exploitation

Question 16

A SOC manager is reviewing their team's detection capabilities against the MITRE ATT&CK framework. They notice a gap in detecting techniques related to 'Credential Access'. Which of the following Splunk ES correlation searches would be most relevant to address this gap?

Accepted Answer

Detect Credential Dumping via LSASS. Credential Access techniques focus on stealing credentials. Credential dumping via LSASS is a core technique (T1003.001) that directly involves extracting credentials from memory. A correlation search detecting this activity would effectively address a gap in Credential Access detection. While other options like Kerberoasting are also Credential Access, they are more specific, whereas LSASS dumping is a broader and highly prevalent method.

Answer

Detect Kerberoasting

Answer

Detect Pass-the-Hash

Answer

Detect Excessive Failed Logins

Question 17

A security analyst is leveraging the Splunk Enterprise Security 'Threat Intelligence' framework to identify adversaries targeting their organization. They have ingested a STIX/TAXII feed containing indicators of compromise (IOCs) associated with a known APT group. The analyst wants to correlate these IOCs with internal events to identify potential compromises. Which of the following is the most accurate method to achieve this correlation in Splunk ES?

Accepted Answer

Use the 'threat_intel' macro within correlation searches to match IOCs against normalized event data.. The most accurate method to correlate ingested IOCs with internal events in Splunk ES is to use the 'threat_intel' macro within correlation searches. This macro performs lookups against the threat intelligence KV store, enriching events with IOC matches and enabling analysts to detect potential compromises. It leverages the framework's automation and is the intended mechanism for such correlation, ensuring efficiency and accuracy.

Answer

Create a custom search that manually extracts IOCs from the STIX/TAXII feed and uses the 'lookup' command to match against events.

Answer

Configure the 'Threat Intelligence' framework to automatically generate notable events for every IOC match without additional correlation searches.

Answer

Enable the 'Threat Intelligence' data model acceleration and run searches against the 'Threat_Intelligence' data model.

Question 18

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

Accepted Answer

Command and Control (C2).. Strict egress filtering on the firewall blocks outbound connections from compromised hosts to attacker-controlled infrastructure, which directly disrupts the Command and Control (C2) phase of the Cyber Kill Chain. Without C2, the attacker cannot issue commands, exfiltrate data, or maintain persistence, making egress filtering one of the most effective C2 mitigations.

Answer

Installation.

Answer

Reconnaissance.

Answer

Exploitation.

Question 19

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Accepted Answer

Email gateway logs and web proxy logs.. The Delivery phase of the Cyber Kill Chain covers how the attacker transmits the weaponized payload to the victim — typically via email attachments, malicious links, or drive-by downloads. Email gateway logs capture delivery attempts (attachments, sender reputation, URL clicks), and web proxy logs capture drive-by download and malicious URL access. These two sources are the primary telemetry for correlating alerts to the Delivery stage.

Answer

Domain Controller authentication logs.

Answer

Internal host process creation logs.

Answer

Endpoint file integrity monitoring.

Question 20

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

Accepted Answer

Assets and Identity Data Model.. The Assets and Identity Data Model is the Splunk Common Information Model (CIM) data model that normalizes asset inventory and identity information — hostnames, IPs, MAC addresses, OS details, and user identities. CIS Control 1 (Inventory and Control of Enterprise Assets) requires knowing every device on the network, and this data model is purpose-built to provide that visibility. It is the essential model for tracking enterprise assets in Splunk.

Answer

Vulnerability Data Model.

Answer

Endpoint Data Model.

Answer

Network Traffic Data Model.

SPLK-5001 Cyber Landscape And Industry Frameworks — All Questions With Answers

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

You are configuring Splunk Enterprise Security to monitor for MITRE ATT&CK 'Persistence' techniques. Which TWO data sources provide the highest fidelity logs for detecting registry-based persistence?

A Splunk ES analyst is mapping detection use cases to the Cyber Kill Chain. They want to prioritize data sources for detecting the 'Command and Control' phase. Which data source is most critical for identifying C2 communications?

A security analyst is mapping Splunk ES detections to the Cyber Kill Chain. The analyst has an alert for a suspicious email attachment that executed a malicious macro. Which phase of the Cyber Kill Chain does this activity represent?

A security analyst is using Splunk Enterprise Security to investigate an alert mapped to the MITRE ATT&CK technique 'T1071 Application Layer Protocol'. Which TWO data sources would provide the most relevant evidence for this technique? (Choose two.)

A SOC manager is reviewing their team's detection capabilities against the MITRE ATT&CK framework. They notice a gap in detecting techniques related to 'Credential Access'. Which of the following Splunk ES correlation searches would be most relevant to address this gap?

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

A security team is mapping their Splunk Enterprise Security detections to the MITRE ATT&CK framework. They want to identify techniques that adversaries use to maintain persistent access on compromised endpoints. Which MITRE ATT&CK tactic should they focus on first?

A security team is aligning its Splunk ES deployment with the NIST Cybersecurity Framework. The team wants to ensure that they can effectively respond to detected incidents by executing predefined procedures. Which NIST CSF function and category should they focus on to achieve this?

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration event. They need to determine which MITRE ATT&CK tactic describes the adversary's objective of stealing data from the compromised network. Which tactic should they reference?

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the "Command and Control" phase. Which of the following data sources would be most relevant for detecting command and control communications?

A Splunk ES analyst is configuring the Threat Intelligence Framework to ingest a STIX/TAXII feed. They need to ensure that the indicators are properly parsed and available for correlation. Which file type must be used to define the threat intelligence source?

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the 'Weaponization' phase. Which activity would be most indicative of this phase?

A Splunk ES analyst is reviewing an incident where an attacker used a compromised user account to move laterally within the network. The analyst wants to map this activity to the MITRE ATT&CK framework. Which tactic best describes the attacker's actions?

A Splunk Enterprise Security analyst is briefing new SOC hires on how the MITRE ATT&CK framework differs from the Cyber Kill Chain when mapping detections. The analyst wants to highlight characteristics that are true of ATT&CK but not of the linear Cyber Kill Chain. (Choose two.)

SPLK-5001 Cyber Landscape And Industry Frameworks — All Questions With Answers

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

You are configuring Splunk Enterprise Security to monitor for MITRE ATT&CK 'Persistence' techniques. Which TWO data sources provide the highest fidelity logs for detecting registry-based persistence?

A Splunk ES analyst is mapping detection use cases to the Cyber Kill Chain. They want to prioritize data sources for detecting the 'Command and Control' phase. Which data source is most critical for identifying C2 communications?

A security analyst is mapping Splunk ES detections to the Cyber Kill Chain. The analyst has an alert for a suspicious email attachment that executed a malicious macro. Which phase of the Cyber Kill Chain does this activity represent?

A security analyst is using Splunk Enterprise Security to investigate an alert mapped to the MITRE ATT&CK technique 'T1071 Application Layer Protocol'. Which TWO data sources would provide the most relevant evidence for this technique? (Choose two.)

A SOC manager is reviewing their team's detection capabilities against the MITRE ATT&CK framework. They notice a gap in detecting techniques related to 'Credential Access'. Which of the following Splunk ES correlation searches would be most relevant to address this gap?

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

A security team is mapping their Splunk Enterprise Security detections to the MITRE ATT&CK framework. They want to identify techniques that adversaries use to maintain persistent access on compromised endpoints. Which MITRE ATT&CK tactic should they focus on first?

A security team is aligning its Splunk ES deployment with the NIST Cybersecurity Framework. The team wants to ensure that they can effectively respond to detected incidents by executing predefined procedures. Which NIST CSF function and category should they focus on to achieve this?

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration event. They need to determine which MITRE ATT&CK tactic describes the adversary's objective of stealing data from the compromised network. Which tactic should they reference?

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the "Command and Control" phase. Which of the following data sources would be most relevant for detecting command and control communications?

A Splunk ES analyst is configuring the Threat Intelligence Framework to ingest a STIX/TAXII feed. They need to ensure that the indicators are properly parsed and available for correlation. Which file type must be used to define the threat intelligence source?

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the 'Weaponization' phase. Which activity would be most indicative of this phase?

A Splunk ES analyst is reviewing an incident where an attacker used a compromised user account to move laterally within the network. The analyst wants to map this activity to the MITRE ATT&CK framework. Which tactic best describes the attacker's actions?

A Splunk Enterprise Security analyst is briefing new SOC hires on how the MITRE ATT&CK framework differs from the Cyber Kill Chain when mapping detections. The analyst wants to highlight characteristics that are true of ATT&CK but not of the linear Cyber Kill Chain. (Choose two.)