Splunk Certified Cybersecurity Defense Analyst (SPLK-5001) (SPLK-5001) (SPLK-5001) — Questions 151–203

You need to modify the default 'Risk Score' logic for a specific asset. Where should this customization occur?

Which THREE commands can be used to handle or create statistical summaries?

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Which command is used to rename a field in the results table for better readability?

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

Which command allows you to limit the number of fields displayed in your final results table?

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?

You need to append the contents of a lookup file 'threat_intel.csv' to your search results based on the field 'src_ip'. Which command is correct?

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

What does the 'OR' operator do in a search?

Which TWO of the following are true regarding the configuration of notable events in Splunk ES?

Which command would you use to filter out events where the 'status' field is 200?

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Which TWO commands are helpful for identifying specific patterns in data?

Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Which THREE commands are used to manipulate multi-value fields?

Which THREE of the following are valid ways to filter events based on time?

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

When using 'stats', how can you include the values of a field as columns in your output?

Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

Which command is used to append results from one search to another?

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

When dealing with multi-value fields, which command allows you to break them into individual events?

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

Which TWO types of events are typically categorized as 'Notable Events'?

Which command is used to remove duplicate events based on a field?

Which THREE actions are necessary to successfully onboard a new data source into Splunk Enterprise Security?

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

An attacker has modified the registry to ensure persistence. Which Splunk ES data model tracks Windows registry changes?

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Which TWO Splunk features are best for automating the execution of recurring threat hunts?

Which TWO commands are commonly used to remove or limit the results returned by a search?

Which TWO of these commands are used for data visualization prep?

When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

A security analyst needs to reduce the noise generated by a specific correlation search that triggers too frequently for authorized internal vulnerability scanners. What is the most efficient way to handle this in Splunk ES?

Which THREE of the following data models are critical for monitoring lateral movement within a network?

You need to correlate a VPN login with a subsequent file access on an internal server. Which Splunk ES feature helps you link these disparate events?

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?