Splunk Certified Cybersecurity Defense Analyst SPLK-5001 practice test

You are reviewing the data ingestion pipeline for Splunk Enterprise Security. To ensure that the CIM (Common Information Model) is correctly applied to your data, which two actions…

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that was generated from a correlation search firing against a risk index. The analyst wants to see the indi…

A Splunk ES analyst is tuning a correlation search that generates a large number of false positives. The analyst wants to reduce noise without disabling the search entirely. The se…

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

A SOC manager is configuring a new correlation search in Splunk ES to detect potential data exfiltration. The search should trigger a notable event and also automatically create a…

When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?

A Splunk ES analyst is investigating a potential ransomware incident. Which TWO of the following are valid indicators of ransomware activity that should be prioritized for detectio…

What is the purpose of the 'map' command in complex searches?

A Splunk security analyst is mapping the organization's detection capabilities to the NIST Cybersecurity Framework (CSF) Core functions. The analyst wants to ensure that the team c…

When a notable event is generated, where does the 'Risk Score' value originate?

A user reports that their files have been encrypted and a ransom note is displayed on their screen. Which type of malware is most likely responsible?

During an investigation of a suspected malware outbreak, an analyst needs to identify all internal hosts that have communicated with a known malicious IP address. Which Splunk ES d…

You are hunting for beaconing activity in proxy logs ingested into Splunk, where an implant contacts its command-and-control server at regular intervals with small jitter. Which an…

A Splunk ES analyst is reviewing an incident where an attacker used a compromised user account to move laterally within the network. The analyst wants to map this activity to the M…

An attacker has gained access to a workstation and is attempting to move laterally within the network. Which TWO of the following techniques are commonly used for lateral movement…

What does the 'OR' operator do in a search?

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous proce…

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

A junior analyst is asked to find all risk events associated with a specific user account to assess potential insider threat activity. Which search command should the analyst use t…