Threat And Attack Types

An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Which THREE of the following data sources are most valuable for detecting an insider threat?

A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

Which THREE of the following components are part of the 'Endpoint' data model?

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

Which THREE of the following are common indicators that a host has been infected with malware?

You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?

Which TWO of the following are common types of social engineering?

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?

Which TWO of the following are examples of reconnaissance techniques used by attackers?

Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?

You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

Which THREE of the following fields are required for mapping data to the 'Authentication' CIM data model?

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

An attacker has modified the registry to ensure persistence. Which Splunk ES data model tracks Windows registry changes?

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

Which THREE of the following data models are critical for monitoring lateral movement within a network?

You need to correlate a VPN login with a subsequent file access on an internal server. Which Splunk ES feature helps you link these disparate events?