CCNA Cyber Landscape And Industry Frameworks Questions

MCQhard

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

A.Navigate to the 'Compliance' tab and run a report on 'Framework Coverage'.

B.Manually edit the 'Data Model' accelerations for NIST compliance.

C.Modify the 'Notable Event' aggregation policy to NIST standards.

D.Update the 'Threat Intelligence' index settings to include NIST tags.

AnswerA

This tab maps installed detections against NIST CSF and shows maturity scores.

Why this answer

The 'Content Introspection' or 'Security Content' dashboard in SSE allows users to filter by framework and maturity to identify coverage gaps.

Practice this question →

MCQmedium

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

A.Email security logs or Web Proxy logs.

B.Local authentication logs.

C.Process audit logs.

D.Registry modification logs.

AnswerA

These are the entry points for most 'Initial Access' vectors.

Why this answer

Initial Access often occurs via phishing or exploited public-facing applications, making web or email logs primary investigation targets.

Practice this question →

Multi-Selectmedium

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

Select 3 answers

A.User Session Tokens

B.Domain Names

C.Network Topology Maps

D.IP Addresses

E.File Hashes

AnswersB, D, E

Domains are a primary type of IoC for C2 detection.

Why this answer

ES allows for the management of Indicators of Compromise (IoCs) including IP addresses, file hashes, and domain names.

Practice this question →

Multi-Selecthard

You are configuring Splunk Enterprise Security to monitor for MITRE ATT&CK 'Persistence' techniques. Which TWO data sources provide the highest fidelity logs for detecting registry-based persistence?

Select 2 answers

A.Windows Security Event Logs (specifically 4688).

B.Sysmon Event IDs 12 and 13.

C.DNS query logs.

D.Netflow logs.

E.Windows Registry audit logs (via GPO/Sysmon).

AnswersB, E

These monitor Registry object creation and value modification.

Why this answer

Registry modifications are typically captured by Sysmon (Event ID 12/13) or local Windows Event logs.

Practice this question →

MCQhard

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

A.The 'Data Model Acceleration' settings.

B.The 'Threat Intelligence' upload manager.

C.The 'Incident Review' dashboard for documenting resolution steps.

D.The 'Workflow Actions' settings for firewall rule creation.

AnswerC

Incident Review is the primary location for managing, documenting, and closing incidents.

Why this answer

The 'Incident Review' dashboard and the 'Notable Event' workflow actions allow for the documentation and categorization of incident resolution and recovery steps.

Practice this question →

MCQmedium

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

A.Utilizing the 'mitre_attack_id' field within the Threat Intelligence framework.

B.Hardcoding the technique description into the 'dest_host' field.

C.Configuring the 'correlation_rule_id' to match the ATT&CK tactic name.

D.Mapping the source IP to the 'mitre_source_id' field.

AnswerA

This is the standard field used to associate threat intel objects with MITRE ATT&CK techniques.

Why this answer

The MITRE ATT&CK mapping in ES relies on the 'mitre_attack_id' field within the threat intelligence framework to correlate events with the enterprise matrix.

Practice this question →

Multi-Selectmedium

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Select 3 answers

A.Containment

B.Reconnaissance

C.Weaponization

D.Exploitation

E.Patching

AnswersB, C, D

This is a valid phase of the Kill Chain.

Why this answer

The Cyber Kill Chain consists of Reconnaissance, Weaponization, Delivery, Exploitation, Installation, C2, and Actions on Objectives.

Practice this question →

MCQhard

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

A.A KV Store collection configured via the 'Threat Intelligence Manager'.

B.An XML-based 'Incident Review' dashboard export.

C.A custom .yml file uploaded to the /etc/system/local directory.

D.A static .conf file in the app bin folder.

AnswerA

Threat intel management in ES relies on KV Store collections to store and map indicators.

Why this answer

The Threat Intelligence framework in ES supports importing custom feeds via CSV or KV Store lookups formatted as threat intel objects, often mapped to MITRE via STIX/TAXII integrations.

Practice this question →

MCQhard

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

A.search sourcetype=sysmon | rename command as powershell.

B.| inputlookup mitre_tactics | where process=powershell.

C.index=main | lookup mitre_attack_id.

D.tstats count from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe.

AnswerD

This is the most efficient way to query endpoint process data for specific commands.

Why this answer

The 'tstats' command is the standard way to query data models efficiently, such as the 'Endpoint' model, to look for malicious PowerShell patterns.

Practice this question →

Multi-Selectmedium

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

Select 3 answers

A.Report

B.Eradicate

C.Detect

D.Protect

E.Identify

AnswersC, D, E

This is a core NIST CSF function.

Why this answer

The five core functions of NIST CSF are Identify, Protect, Detect, Respond, and Recover.

Practice this question →

Multi-Selecthard

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

Select 2 answers

A.Notable Events framework.

B.Workload Management.

C.Data Model acceleration.

D.Correlation Searches.

E.Report acceleration.

AnswersA, D

This framework manages the output of detected threats.

Why this answer

The 'Notable Events' framework and 'Correlation Searches' are the primary mechanisms in ES for detecting and surfacing security anomalies.

Practice this question →

MCQeasy

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

A.Sending a spear-phishing email.

B.Encrypting user files for ransom.

C.Installing a backdoor on a web server.

D.Scanning external IP ranges for open ports.

AnswerD

Port scanning is a common reconnaissance technique.

Why this answer

Reconnaissance involves active or passive research performed by an attacker to gather information on a target's infrastructure.

Practice this question →

MCQeasy

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

A.Domain Controller authentication logs.

B.Email gateway logs and web proxy logs.

C.Internal host process creation logs.

D.Endpoint file integrity monitoring.

AnswerB

These are the primary sources for detecting the delivery of malicious content.

Why this answer

The Delivery phase involves getting the malicious payload to the target, typically via email, web, or file transfer.

Practice this question →

Multi-Selecthard

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Select 2 answers

A.Configure all logs to use the 'Syslog' protocol only.

B.Enablement of the 'Splunk App for CIS Benchmarks'.

C.Install a third-party antivirus solution.

D.Deployment of the Splunk Universal Forwarder on target endpoints.

E.Configure the index to 'Hot/Warm' storage only.

AnswersB, D

This app provides the logic to compare incoming configuration data against known CIS standards.

Why this answer

To report on CIS benchmarks, you need to collect the configuration data and have a mechanism to compare it against the expected state (the benchmark).

Practice this question →

MCQeasy

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

A.Installation.

B.Command and Control (C2).

C.Reconnaissance.

D.Exploitation.

AnswerB

C2 requires outbound communication to an attacker-controlled server.

Why this answer

Egress filtering prevents infected hosts from communicating with external Command and Control (C2) servers.

Practice this question →

MCQmedium

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

A.The 'Network Resolution' Data Model.

B.The 'Vulnerability' Data Model.

C.The 'Authentication' Data Model.

D.The 'Malware' Data Model.

AnswerC

Tracking lateral movement often requires identifying authentication events between systems.

Why this answer

The 'Authentication' data model is critical for tracking account usage, which is the primary method for lateral movement.

Practice this question →

MCQmedium

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

A.Vulnerability Data Model.

B.Assets and Identity Data Model.

C.Endpoint Data Model.

D.Network Traffic Data Model.

AnswerB

This model is specifically designed to store and correlate asset inventory information.

Why this answer

The 'Inventory' data model (part of the Common Information Model) is the foundation for asset tracking in Splunk ES.

Practice this question →

MCQmedium

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

A.Splunk Add-on for Linux Auditd.

B.Splunk App for Infrastructure (SAI).

C.Splunk App for CIS Benchmarks.

D.Splunk Enterprise Security Vulnerability Scanner.

AnswerC

This app provides out-of-the-box dashboards for CIS compliance.

Why this answer

Splunk Add-on for CIS (or specifically the Splunk App for CIS Benchmarks) is the designated tool for importing and visualizing these audits.

Practice this question →

MCQhard

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

A.Index-time field extraction.

B.Correlation search thresholding.

C.Dynamic Threat Intelligence updates.

D.Asset and Identity framework using lookup tables.

AnswerD

Lookups are the standard way to feed authorized lists into Splunk for comparison.

Why this answer

The 'Asset and Identity' framework in ES allows for the ingestion of authoritative lists of software and assets for comparison against endpoint logs.

Practice this question →

MCQeasy

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

A.Establishing a persistent connection to the attacker.

B.Executing code to take advantage of a vulnerability.

C.Exfiltrating sensitive company data.

D.Gathering information about the target.

AnswerB

This is the definition of exploitation.

Why this answer

The Exploitation phase involves the attacker taking advantage of a vulnerability to gain access to the system.

Practice this question →