Cyber Landscape And Industry Frameworks

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

A SOC manager is aligning Splunk Enterprise Security with the NIST Cybersecurity Framework. They need to ensure that the 'Respond' function is properly supported. Which Splunk ES feature is specifically designed to facilitate the 'Respond' function by automating actions such as blocking IPs or disabling users?

A security analyst is mapping Splunk ES correlation searches to the MITRE ATT&CK framework. The analyst needs to identify the technique that describes adversaries using legitimate credentials to access accounts, which often enables lateral movement and evasion. Which MITRE ATT&CK technique should the analyst map to?

A Splunk ES analyst is configuring the Threat Intelligence Framework to ingest a STIX/TAXII feed. They need to ensure that the indicators are properly parsed and available for correlation. Which file type must be used to define the threat intelligence source?

A security team is aligning their Splunk ES deployment with the NIST Cybersecurity Framework (CSF) 'Respond' function. They want to ensure that their incident response capabilities are properly supported by Splunk ES features. Which TWO of the following Splunk ES features are most directly aligned with the 'Respond' function? (Choose two.)

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

A healthcare SOC is preparing an executive briefing that maps its Splunk Enterprise Security detections to the NIST Cybersecurity Framework 2.0. The CISO specifically asks which function covers activities such as establishing policies, defining roles, and performing risk assessments before any incident occurs. Which NIST CSF 2.0 function should the analyst cite for these governance and risk-management activities?

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

A security team is aligning its Splunk ES deployment with the NIST Cybersecurity Framework. The team wants to ensure that they can effectively respond to detected incidents by executing predefined procedures. Which NIST CSF function and category should they focus on to achieve this?

An analyst is investigating a potential data exfiltration incident and wants to determine the adversary's stage according to the Cyber Kill Chain. The analyst observes large outbound transfers to an unfamiliar external IP address after a period of internal reconnaissance. Which phase of the Cyber Kill Chain does this activity represent?

A security team is mapping its Splunk Enterprise Security (ES) detections to the MITRE ATT&CK framework. The team wants to identify all active detections that can detect adversary behavior related to credential dumping. Which Splunk ES feature should they use to view the MITRE ATT&CK techniques and the associated detections?

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration incident. The analyst wants to determine the stage of the attack according to the Cyber Kill Chain. The analyst observes that a large volume of data is being transferred from an internal database server to an external IP address. Which phase of the Cyber Kill Chain does this activity represent?

A Splunk ES analyst is investigating an incident and needs to determine the potential impact of a compromised user account. The analyst wants to see all assets and identities associated with the user, including their roles and privileges, to assess lateral movement risks. Which Splunk ES feature should the analyst use?

A retail company's SOC uses Splunk Enterprise Security to enrich alerts with threat intelligence. The intelligence lead wants to categorize feeds so analysts know whether an indicator is a raw observable, contextual reporting about an actor, or a confirmed malicious indicator. Which model should the analyst use to classify these feeds as strategic, operational, tactical, or technical intelligence?

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

A Splunk Enterprise Security analyst is briefing new SOC hires on how the MITRE ATT&CK framework differs from the Cyber Kill Chain when mapping detections. The analyst wants to highlight characteristics that are true of ATT&CK but not of the linear Cyber Kill Chain. (Choose two.)

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the 'Weaponization' phase. Which activity would be most indicative of this phase?

A security team is mapping their Splunk Enterprise Security detections to the MITRE ATT&CK framework. They want to identify techniques that adversaries use to maintain persistent access on compromised endpoints. Which MITRE ATT&CK tactic should they focus on first?

A security team at a financial institution is aligning its detection capabilities with the MITRE ATT&CK framework. They want to identify techniques related to the 'Credential Access' tactic. Which TWO of the following are MITRE ATT&CK techniques that belong to the Credential Access tactic? (Choose two.)

A security operations center (SOC) is using Splunk Enterprise Security to align with the MITRE ATT&CK framework. The team wants to improve detection of techniques within the 'Credential Access' tactic. Which TWO of the following data sources are most critical to enable for detecting credential dumping techniques such as LSASS memory access? (Choose two.)

A SOC manager wants to measure the effectiveness of detection coverage against the MITRE ATT&CK framework using Splunk Enterprise Security. The manager needs to visualize which tactics have the most and least coverage based on enabled correlation searches. Which Splunk ES feature should be used to generate this coverage map?

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

A security team wants to align their Splunk Enterprise Security (ES) deployment with the NIST Cybersecurity Framework (CSF) 2.0 to improve governance and risk management. They are specifically focused on the 'Identify' function. Which of the following activities best exemplifies the use of Splunk ES to support the 'Identify' function?

A security analyst is reviewing an incident where an attacker used the technique 'T1071.001 - Application Layer Protocol: Web Protocols' for command and control. The analyst needs to identify which data sources in Splunk ES would be most effective for detecting this activity. Which of the following data sources should be prioritized?

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

A Splunk security analyst is mapping the organization's detection capabilities to the NIST Cybersecurity Framework (CSF) Core functions. The analyst wants to ensure that the team can effectively identify anomalous activity across the enterprise. Which CSF function should the analyst prioritize to meet this objective?

A Splunk ES analyst is reviewing an incident where an attacker used a compromised user account to move laterally within the network. The analyst wants to map this activity to the MITRE ATT&CK framework. Which tactic best describes the attacker's actions?

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration event. They need to determine which MITRE ATT&CK tactic describes the adversary's objective of stealing data from the compromised network. Which tactic should they reference?

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the "Command and Control" phase. Which of the following data sources would be most relevant for detecting command and control communications?

You are aligning your Splunk ES deployment with the NIST Cybersecurity Framework (CSF) to improve your organization's security posture. The CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Which TWO of the following Splunk ES capabilities most directly support the 'Respond' function? (Choose two.)

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

You are a security analyst using Splunk Enterprise Security (ES) to map detections to the MITRE ATT&CK framework. Your CISO wants to understand which ATT&CK tactic is most directly addressed by the correlation search that detects suspicious PowerShell execution with encoded commands (T1059.001). Under which ATT&CK tactic should you classify this detection?

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

A Splunk ES analyst is investigating an alert for a suspicious PowerShell script execution. The alert is mapped to MITRE ATT&CK technique T1059.001 (PowerShell). To gather more context, the analyst wants to search for related events across multiple data sources. Which Splunk ES feature should they use to pivot from the alert to relevant events?