Courseiva

CCNA Cyber Landscape And Industry Frameworks Questions

41 questions · Cyber Landscape And Industry Frameworks topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

A.Email security logs or Web Proxy logs.
B.Local authentication logs.
C.Process audit logs.
D.Registry modification logs.
AnswerA

Initial Access covers techniques such as phishing and drive-by compromise, which arrive via email attachments, links, or malicious web content. Email security and web proxy logs record those delivery vectors, giving the primary evidence needed to trace how the intrusion began.

Why this answer

MITRE ATT&CK's Initial Access tactic covers techniques like phishing (T1566), exploitation of public-facing applications (T1190), and valid accounts (T1078). Phishing is the most common initial access vector, so email security logs are primary for detecting malicious attachments, links, and sender anomalies. Web proxy logs are also primary because they capture drive-by compromise and access to malicious URLs used in initial access.

Together they provide the telemetry needed to investigate Initial Access alerts.

Exam trap

SPLK-5001 often tests whether candidates confuse Initial Access with Execution or Credential Access — the trap is selecting process or authentication logs when the question is specifically about how the attacker first got in.

How to eliminate wrong answers

Option B is wrong because local authentication logs map to Credential Access (e.g., brute force, T1110) or Lateral Movement, not Initial Access — they show logon attempts on a host, which is a later-stage concern. Option C is wrong because process audit logs correspond to Execution (T1059) and later tactics; process creation happens after initial access is achieved. Option D is wrong because registry modification logs map to Persistence (T1547) and Defense Evasion (T1112), which occur after the attacker has already gained a foothold.

Practice this question →
2
MCQhard

A SOC manager is aligning Splunk Enterprise Security with the NIST Cybersecurity Framework. They need to ensure that the 'Respond' function is properly supported. Which Splunk ES feature is specifically designed to facilitate the 'Respond' function by automating actions such as blocking IPs or disabling users?

A.Incident Review
B.Threat Intelligence Framework
C.Risk Analysis
D.Adaptive Response
AnswerD

Adaptive Response in Splunk ES enables automated and manual actions to be taken directly from notable events, such as blocking an IP on a firewall or disabling a user account in Active Directory. It maps directly to the NIST CSF Respond function by providing the capability to contain and mitigate incidents quickly. This feature integrates with third-party tools via adaptive response actions.

Why this answer

Adaptive Response is the Splunk ES feature that directly supports the NIST CSF Respond function by enabling automated and manual actions on notable events. It allows analysts to execute scripts, block IPs, disable users, and more, thereby containing threats rapidly. This aligns with the Respond function's objectives of containment, mitigation, and improvement.

Exam trap

The trap here is assuming that Incident Review, which is used for triage, also automates response actions, but it only manages the workflow.

Practice this question →
3
MCQmedium

A security analyst is mapping Splunk ES correlation searches to the MITRE ATT&CK framework. The analyst needs to identify the technique that describes adversaries using legitimate credentials to access accounts, which often enables lateral movement and evasion. Which MITRE ATT&CK technique should the analyst map to?

A.T1078 - Valid Accounts
B.T1110 - Brute Force
C.T1059 - Command and Scripting Interpreter
D.T1021 - Remote Services
AnswerA

T1078 Valid Accounts describes adversaries obtaining and using credentials of existing accounts to gain access, escalate privileges, and move laterally. It is a precise match because the scenario emphasizes legitimate credentials, which are often undetected by traditional defenses. Mapping to this technique helps analysts focus on anomalous account usage rather than exploit-based intrusions.

Why this answer

The scenario describes adversaries leveraging legitimate credentials to access accounts, which is the definition of MITRE ATT&CK technique T1078 Valid Accounts. This technique covers initial access, persistence, privilege escalation, and defense evasion using valid accounts. Mapping to T1078 helps analysts detect anomalous logins and account misuse, aligning with the need to identify credential-based threats in Splunk ES.

Exam trap

The trap here is confusing the means of obtaining credentials (such as brute force) with the subsequent use of already-valid credentials to access accounts.

Practice this question →
4
MCQmedium

A Splunk ES analyst is configuring the Threat Intelligence Framework to ingest a STIX/TAXII feed. They need to ensure that the indicators are properly parsed and available for correlation. Which file type must be used to define the threat intelligence source?

A.CSV
B.JSON
C.XML
D.conf
AnswerD

The Threat Intelligence Framework uses Splunk configuration files, such as threat_intelligence.conf, to define threat intelligence sources, including STIX/TAXII feeds. These .conf files specify the TAXII server URL, collection, and other parameters. This is the correct file type for configuring the source.

Why this answer

To define a threat intelligence source in Splunk ES, including STIX/TAXII feeds, you must use Splunk configuration files, specifically threat_intelligence.conf. This file allows you to specify the TAXII server details, authentication, and polling intervals. CSV, JSON, and XML are data formats for indicators but are not used to define the source itself.

Exam trap

The trap here is assuming that JSON or XML is used to configure the source because STIX is based on JSON; however, the source definition in Splunk ES is always done through .conf files.

Practice this question →
5
Multi-Selecthard

A security team is aligning their Splunk ES deployment with the NIST Cybersecurity Framework (CSF) 'Respond' function. They want to ensure that their incident response capabilities are properly supported by Splunk ES features. Which TWO of the following Splunk ES features are most directly aligned with the 'Respond' function? (Choose two.)

Select 2 answers
A.Threat Intelligence Framework
B.Asset & Identity Framework
C.Adaptive Response
D.Protocol Intelligence
E.Incident Review
AnswersC, E

Adaptive Response in Splunk ES enables automated or manual actions in response to notable events, such as blocking an IP on a firewall or disabling a user account. This directly supports the 'Respond' function by providing the capability to take action against threats. It integrates with various security tools to execute response actions, making it a core component of incident response in Splunk ES.

Why this answer

The NIST CSF 'Respond' function focuses on taking action after a cybersecurity incident is detected. In Splunk ES, Incident Review provides a centralized workflow for triaging, assigning, and managing incidents, while Adaptive Response enables automated or manual response actions to mitigate threats. Together, these features directly support incident response activities.

Other features like Threat Intelligence, Asset & Identity, and Protocol Intelligence enhance detection and investigation but are not primarily designed for executing response actions.

Exam trap

The trap here is confusing detection-enhancing features with response capabilities, assuming that any security feature contributes equally to the 'Respond' function.

Practice this question →
6
Multi-Selectmedium

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

Select 3 answers
A.User Session Tokens
B.Domain Names
C.Network Topology Maps
D.IP Addresses
E.File Hashes
AnswersB, D, E

Domain names are a supported threat intelligence category in the Splunk Enterprise Security framework, satisfying the stem's requirement. They populate the intel store for correlation against DNS and web proxy events, enabling detection of command-and-control, phishing and malicious infrastructure lookups.

Why this answer

The Splunk Enterprise Security Threat Intelligence framework organizes indicators into specific intelligence types that can be uploaded, matched against events, and used in correlation searches. Option B (Domain Names) is correct because domain indicators are a supported threat intelligence type, typically stored in the 'domains' intelligence type and used to detect DNS-based malicious activity. Option D (IP Addresses) is correct because IP addresses are a core supported type, stored as the 'ip_intel' intelligence type and used to match network traffic against known malicious hosts.

Option E (File Hashes) is correct because file hash indicators (such as MD5, SHA-1, and SHA-256) are supported as the 'file_intel' intelligence type for detecting known malicious files. Option A (User Session Tokens) is not a threat intelligence category in the framework; session tokens are authentication artifacts, not indicators of compromise. Option C (Network Topology Maps) is not a threat intelligence category either; topology maps are network documentation, not actionable threat indicators.

Exam trap

SPLK-5001 often tests the specific categories supported by the Threat Intelligence framework, and candidates may confuse it with other security features like user behavior analytics or network mapping, leading them to select incorrect options.

Practice this question →
7
MCQmedium

A healthcare SOC is preparing an executive briefing that maps its Splunk Enterprise Security detections to the NIST Cybersecurity Framework 2.0. The CISO specifically asks which function covers activities such as establishing policies, defining roles, and performing risk assessments before any incident occurs. Which NIST CSF 2.0 function should the analyst cite for these governance and risk-management activities?

A.IDENTIFY (ID)
B.GOVERN (GV)
C.RESPOND (RS)
D.PROTECT (PR)
AnswerB

GOVERN is the function added in NIST CSF 2.0 that houses organizational risk-management strategy, policy, roles, responsibilities, and supply-chain risk. Establishing policies and defining roles before incidents occur is exactly this function's scope, so citing it answers the CISO's question about pre-incident governance activities accurately.

Why this answer

NIST CSF 2.0 introduced the GOVERN function to elevate cybersecurity risk management to organizational governance, covering policy, roles, responsibilities, and risk strategy. Because the CISO described policy creation, role definition, and pre-incident risk assessment rather than asset inventory or safeguards, the governance-oriented function is the accurate mapping for the briefing.

Exam trap

The trap here is assuming any pre-incident or planning activity must belong to IDENTIFY, when CSF 2.0 moved policy, roles, and risk-strategy activities into the separate GOVERN function.

Practice this question →
8
MCQhard

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

A.The 'Data Model Acceleration' settings.
B.The 'Threat Intelligence' upload manager.
C.The 'Incident Review' dashboard for documenting resolution steps.
D.The 'Workflow Actions' settings for firewall rule creation.
AnswerC

The 'Recover' function requires documenting how incidents are resolved and lessons captured. The Incident Review dashboard records investigation findings, resolution steps and post-incident notes, providing the audit trail needed to evidence recovery activities against NIST CSF requirements.

Why this answer

The 'Incident Review' dashboard in Splunk Enterprise Security is the built-in workspace where analysts document investigation findings, resolution steps, and post-incident notes tied to notable events. This directly supports the NIST CSF 'Recover' function, which emphasizes restoring capabilities and documenting lessons learned after an incident. Because Incident Review captures the full lifecycle of a notable event — from triage through closure — it is the natural artifact for demonstrating a documented incident response process.

Exam trap

SPLK-5001 often tests whether candidates confuse ES features that execute response actions (Workflow Actions) with those that document response actions (Incident Review) — the word 'documenting' is the key discriminator.

How to eliminate wrong answers

Option A is wrong because Data Model Acceleration is a performance optimization that speeds up searches against accelerated data models; it has nothing to do with documenting incident response. Option B is wrong because the Threat Intelligence upload manager ingests IOC feeds for detection enrichment, not for capturing incident resolution narratives. Option D is wrong because Workflow Actions automate outbound actions (like creating firewall rules) from notable events — they execute responses, they don't document the response process.

Practice this question →
9
MCQhard

A security team is aligning its Splunk ES deployment with the NIST Cybersecurity Framework. The team wants to ensure that they can effectively respond to detected incidents by executing predefined procedures. Which NIST CSF function and category should they focus on to achieve this?

A.Respond (RS) - Response Planning (RS.RP)
B.Identify (ID) - Business Environment (ID.BE)
C.Recover (RC) - Recovery Planning (RC.RP)
D.Detect (DE) - Detection Processes (DE.DP)
AnswerA

The Respond function includes the Response Planning category, which ensures that response processes and procedures are executed and maintained. This directly supports the team's goal of having predefined procedures to respond to incidents. By focusing on RS.RP, they can develop, test, and update response plans, ensuring effective incident handling.

Why this answer

The NIST CSF Respond function includes Response Planning, which ensures that response processes and procedures are executed and maintained. This category is directly aimed at enabling organizations to respond effectively to detected cybersecurity incidents. By focusing on RS.RP, the team can establish, test, and improve their incident response plans, aligning with their goal of executing predefined procedures.

Exam trap

The trap here is confusing the Detect function's detection processes with the Respond function's response planning, when the scenario explicitly requires executing response procedures.

Practice this question →
10
MCQmedium

An analyst is investigating a potential data exfiltration incident and wants to determine the adversary's stage according to the Cyber Kill Chain. The analyst observes large outbound transfers to an unfamiliar external IP address after a period of internal reconnaissance. Which phase of the Cyber Kill Chain does this activity represent?

A.Actions on Objectives
B.Exploitation
C.Installation
D.Command and Control
AnswerA

Actions on Objectives is the final phase of the Cyber Kill Chain, where the adversary achieves their goal, such as data exfiltration, data destruction, or disruption. The scenario shows large outbound transfers to an external IP, indicating data theft, which is a classic objective. This phase directly matches the observed activity.

Why this answer

The Cyber Kill Chain phase Actions on Objectives encompasses the adversary's ultimate goal, which often includes data exfiltration. The large outbound transfers to an unfamiliar external IP after reconnaissance strongly indicate that the adversary is now stealing data. Recognizing this phase helps analysts prioritize containment and recovery efforts, as the breach has progressed to its final stage.

Exam trap

The trap here is mistaking data exfiltration for Command and Control, when C2 is about maintaining communication, not the actual theft of data.

Practice this question →
11
MCQmedium

A security team is mapping its Splunk Enterprise Security (ES) detections to the MITRE ATT&CK framework. The team wants to identify all active detections that can detect adversary behavior related to credential dumping. Which Splunk ES feature should they use to view the MITRE ATT&CK techniques and the associated detections?

A.Threat Intelligence Framework
B.MITRE ATT&CK Dashboard
C.Asset & Identity Framework
D.Incident Review
AnswerB

The MITRE ATT&CK Dashboard in Splunk ES provides a visual mapping of detections to ATT&CK techniques. Analysts can filter by tactic or technique, such as Credential Dumping (T1003), to see which correlation searches are associated. This allows the team to quickly identify active detections that can detect credential dumping behavior, making it the appropriate feature for this scenario.

Why this answer

The MITRE ATT&CK Dashboard in Splunk ES is designed to map detections to adversary techniques. It allows security teams to filter by technique, such as Credential Dumping, and see which correlation searches are enabled and relevant. This directly supports the goal of identifying active detections for credential dumping, unlike other features that focus on threat intelligence, asset management, or incident triage.

Exam trap

The trap here is confusing threat intelligence feeds with detection mapping, assuming that any threat-related feature will show ATT&CK coverage.

Practice this question →
12
MCQmedium

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration incident. The analyst wants to determine the stage of the attack according to the Cyber Kill Chain. The analyst observes that a large volume of data is being transferred from an internal database server to an external IP address. Which phase of the Cyber Kill Chain does this activity represent?

A.Actions on Objectives
B.Command and Control
C.Installation
D.Exploitation
AnswerA

Actions on Objectives is the final phase of the Cyber Kill Chain, where the attacker accomplishes their goal, such as data exfiltration, data destruction, or disruption. The large data transfer from an internal database to an external IP directly indicates exfiltration, which falls under Actions on Objectives. This is the correct phase to classify this activity.

Why this answer

The Cyber Kill Chain's Actions on Objectives phase encompasses the attacker's ultimate goal, which often includes data exfiltration. The observation of a large data transfer from an internal database to an external IP is a clear indicator of exfiltration, placing it in the Actions on Objectives phase. This phase occurs after the attacker has established a foothold and command-and-control, and is now executing their mission.

Exam trap

The trap here is misclassifying data exfiltration as Command and Control because both involve network traffic; however, Command and Control is about establishing a channel, while exfiltration is the actual data theft.

Practice this question →
13
MCQmedium

A Splunk ES analyst is investigating an incident and needs to determine the potential impact of a compromised user account. The analyst wants to see all assets and identities associated with the user, including their roles and privileges, to assess lateral movement risks. Which Splunk ES feature should the analyst use?

A.Protocol Intelligence
B.Threat Intelligence Framework
C.Asset & Identity Framework
D.Incident Review
AnswerC

The Asset & Identity Framework in Splunk ES allows analysts to centrally manage and correlate information about assets (e.g., servers, endpoints) and identities (e.g., users). It includes details such as user roles, privileges, and associated assets. By using this framework, the analyst can quickly see all assets and identities linked to the compromised user, assess their privileges, and evaluate lateral movement risks. This makes it the appropriate feature for this scenario.

Why this answer

The Asset & Identity Framework is designed to manage and correlate asset and identity information, including user roles and privileges. When a user account is compromised, analysts can use this framework to view all associated assets and identities, understand the user's access level, and identify potential lateral movement paths. This directly supports impact assessment.

Other features like Incident Review or Threat Intelligence may provide context but do not centralize identity and asset data.

Exam trap

The trap here is assuming that Incident Review provides all necessary context, but it relies on the Asset & Identity Framework for enrichment and does not manage the data itself.

Practice this question →
14
MCQhard

A retail company's SOC uses Splunk Enterprise Security to enrich alerts with threat intelligence. The intelligence lead wants to categorize feeds so analysts know whether an indicator is a raw observable, contextual reporting about an actor, or a confirmed malicious indicator. Which model should the analyst use to classify these feeds as strategic, operational, tactical, or technical intelligence?

A.The Diamond Model of Intrusion Analysis
B.The Cyber Kill Chain
C.The MITRE ATT&CK Enterprise matrix
D.The threat intelligence tier model (strategic, operational, tactical, technical)
AnswerD

The commonly used intelligence tier model separates strategic intelligence for executives, operational intelligence about campaigns and actor intent, tactical intelligence such as TTPs, and technical intelligence like IPs, domains, and file hashes. This directly matches the lead's need to label feeds as raw observables, contextual reporting, or confirmed malicious indicators.

Why this answer

Threat intelligence is commonly organized into strategic, operational, tactical, and technical tiers based on audience and content. Strategic informs leadership decisions, operational describes campaigns and intent, tactical captures TTPs, and technical delivers machine-consumable observables such as hashes and domains. This tier model is what allows the intelligence lead to label feeds consistently inside an enrichment workflow.

Exam trap

The trap here is conflating attack-mapping frameworks such as ATT&CK or the Kill Chain with intelligence classification tiers, even though those frameworks describe adversary behavior rather than feed categories.

Practice this question →
15
Multi-Selectmedium

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Select 3 answers
A.Containment
B.Reconnaissance
C.Weaponization
D.Exploitation
E.Patching
AnswersB, C, D

Reconnaissance is the first phase of the Cyber Kill Chain, covering the attacker's research and target selection before any exploitation occurs. It satisfies the stem's requirement for a commonly defined phase, alongside Weaponisation, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives.

Why this answer

The Cyber Kill Chain, developed by Lockheed Martin, defines seven sequential phases of an intrusion: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Option B (Reconnaissance) is correct because it is the first phase, where the attacker gathers information about the target (e.g., via OSINT, scanning, or social engineering). Option C (Weaponization) is correct because it is the phase where the attacker pairs a remote access trojan or exploit with a deliverable payload (e.g., a malicious document or exploit kit).

Option D (Exploitation) is correct because it is the phase where the malicious code is triggered to take advantage of a vulnerability on the target system. Option A (Containment) is not part of the Cyber Kill Chain; it belongs to incident response frameworks such as NIST SP 800-61 (containment, eradication, recovery). Option E (Patching) is not a kill chain phase either; it is a defensive remediation activity, not an attacker phase in the model.

Exam trap

SPLK-5001 often tests the confusion between the Cyber Kill Chain phases and incident response lifecycle phases (NIST) — candidates pick 'Containment' because it sounds like a security phase, but it belongs to IR, not the kill chain.

Practice this question →
16
Multi-Selectmedium

A Splunk Enterprise Security analyst is briefing new SOC hires on how the MITRE ATT&CK framework differs from the Cyber Kill Chain when mapping detections. The analyst wants to highlight characteristics that are true of ATT&CK but not of the linear Cyber Kill Chain. (Choose two.)

Select 2 answers
A.ATT&CK presents adversary behavior as a strictly sequential set of phases that must occur in order.
B.ATT&CK requires that each detected technique be assigned to exactly one of seven fixed phases.
C.ATT&CK can be used to assess defensive coverage gaps by identifying techniques with no associated detections.
D.ATT&CK organizes adversary behavior into tactics and techniques with platform-specific sub-techniques.
E.ATT&CK was created to replace the need for any threat intelligence feeds in a SOC.
AnswersC, D

Because ATT&CK enumerates observable techniques, teams can overlay their detection content and see which techniques lack coverage. This coverage-gap analysis is a core ATT&CK use case and is not a native capability of the Cyber Kill Chain, whose seven phases are too coarse to reveal granular detection shortfalls.

Why this answer

ATT&CK's tactic-and-technique structure, including platform-specific sub-techniques, and its suitability for detection coverage-gap analysis distinguish it from the Cyber Kill Chain's seven ordered phases. The kill chain shows roughly where an intrusion sits; ATT&CK shows what specific behaviors to detect, which is why SOC teams use it to prioritize and measure detection engineering in Splunk ES.

Exam trap

The trap here is treating ATT&CK and the Cyber Kill Chain as interchangeable linear models, when ATT&CK is non-sequential and technique-granular while the kill chain is a fixed seven-phase progression.

Practice this question →
17
MCQmedium

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the 'Weaponization' phase. Which activity would be most indicative of this phase?

A.A compromised host begins beaconing to a command and control server.
B.An attacker exfiltrates sensitive data from the network.
C.An attacker creates a malicious document by embedding a macro that downloads a payload.
D.A user receives a phishing email with a malicious attachment.
AnswerC

Weaponization is the phase where the adversary creates the attack vector, such as coupling an exploit with a deliverable payload. Embedding a macro in a document is a classic weaponization step. In Splunk ES, detections for this phase are challenging because it occurs on adversary infrastructure, but threat intelligence can provide indicators of known weaponized files.

Why this answer

Weaponization is the phase where the adversary creates the malicious payload, such as a weaponized document or exploit. In Splunk ES, this phase is difficult to detect directly because it happens on adversary systems, but threat intelligence feeds can provide known malicious file hashes. Understanding this phase helps analysts prioritize prevention at the delivery stage.

Exam trap

The trap here is mixing up Delivery and Weaponization, since both involve the malicious payload, but Weaponization is the creation, not the transmission.

Practice this question →
18
MCQeasy

A security team is mapping their Splunk Enterprise Security detections to the MITRE ATT&CK framework. They want to identify techniques that adversaries use to maintain persistent access on compromised endpoints. Which MITRE ATT&CK tactic should they focus on first?

A.Defense Evasion
B.Credential Access
C.Persistence
D.Privilege Escalation
AnswerC

Persistence is the ATT&CK tactic that covers techniques adversaries use to keep access to systems across restarts, changed credentials, and other interruptions. The team should map detections for registry run keys, scheduled tasks, and services to this tactic. Splunk ES includes correlation searches aligned to Persistence so analysts can quickly surface suspicious autorun modifications.

Why this answer

Persistence is the correct tactic because it directly addresses the adversary's goal of maintaining a foothold on a compromised system. Detections such as unauthorized scheduled tasks, new services, or registry run key modifications are classic persistence techniques. Aligning these with the Persistence tactic in Splunk ES ensures accurate ATT&CK coverage reporting and focused threat hunting.

Exam trap

The trap here is confusing persistence with privilege escalation, since both often occur after initial access, but only persistence specifically describes maintaining access over time.

Practice this question →
19
Multi-Selectmedium

A security team at a financial institution is aligning its detection capabilities with the MITRE ATT&CK framework. They want to identify techniques related to the 'Credential Access' tactic. Which TWO of the following are MITRE ATT&CK techniques that belong to the Credential Access tactic? (Choose two.)

Select 2 answers
A.Registry Run Keys / Startup Folder
B.Spearphishing Attachment
C.Brute Force
D.Exploitation for Credential Access
E.Process Discovery
AnswersC, D

Brute Force is a technique under Credential Access (T1110). It involves adversaries attempting to gain access by systematically trying passwords or passphrases. This aligns with the scenario's need to identify Credential Access techniques, as it directly targets credential compromise.

Why this answer

The MITRE ATT&CK Credential Access tactic includes techniques such as Brute Force (T1110) and Exploitation for Credential Access (T1212). These techniques are specifically aimed at stealing credentials, such as account names and passwords. Spearphishing Attachment, Process Discovery, and Registry Run Keys belong to other tactics like Initial Access, Discovery, and Persistence, respectively.

Exam trap

The trap here is assuming that any technique involving credentials falls under Credential Access, when in fact techniques like Spearphishing Attachment may lead to credential theft but are categorized under Initial Access.

Practice this question →
20
Multi-Selecthard

A security operations center (SOC) is using Splunk Enterprise Security to align with the MITRE ATT&CK framework. The team wants to improve detection of techniques within the 'Credential Access' tactic. Which TWO of the following data sources are most critical to enable for detecting credential dumping techniques such as LSASS memory access? (Choose two.)

Select 2 answers
A.Windows Security Event Logs (e.g., Event ID 4624, 4672)
B.Sysmon Event Logs (e.g., Event ID 10: ProcessAccess)
C.Endpoint Detection and Response (EDR) telemetry
D.Firewall logs
E.Windows PowerShell Operational Logs (e.g., Event ID 4104)
AnswersB, C

Sysmon Event ID 10 (ProcessAccess) logs when a process accesses another process, including access to LSASS memory. This is a primary data source for detecting credential dumping tools like Mimikatz that attempt to read LSASS memory. Enabling Sysmon with appropriate configuration provides the granular visibility needed to identify such techniques, making it critical for this scenario.

Why this answer

Detecting credential dumping techniques such as LSASS memory access requires endpoint-level visibility. Sysmon Event ID 10 logs process access to LSASS, and EDR telemetry provides detailed monitoring of memory access and API calls. Together, these data sources enable Splunk ES to identify and alert on credential dumping attempts.

Windows Security Event Logs, PowerShell logs, and firewall logs, while valuable for other detections, do not provide the direct memory access visibility needed here.

Exam trap

The trap here is assuming that Windows Security Event Logs or PowerShell logs alone can detect LSASS memory access; they lack the necessary process-level detail.

Practice this question →
21
MCQhard

A SOC manager wants to measure the effectiveness of detection coverage against the MITRE ATT&CK framework using Splunk Enterprise Security. The manager needs to visualize which tactics have the most and least coverage based on enabled correlation searches. Which Splunk ES feature should be used to generate this coverage map?

A.Risk Analysis Framework
B.Threat Intelligence Management
C.Asset and Identity Framework
D.MITRE ATT&CK Dashboard
AnswerD

The MITRE ATT&CK Dashboard in Splunk ES provides a visual representation of the ATT&CK matrix, showing which techniques have associated correlation searches and their status. It helps analysts and managers identify coverage gaps by highlighting tactics and techniques with no or few detections. This directly addresses the need to measure detection effectiveness against the framework.

Why this answer

The MITRE ATT&CK Dashboard in Splunk ES is designed to map correlation searches to ATT&CK techniques and display coverage across the matrix. It allows managers to quickly see which tactics and techniques are covered and which are not, enabling informed decisions about detection engineering priorities. This aligns with the goal of measuring detection effectiveness against the framework.

Exam trap

The trap here is assuming that any security dashboard or risk-based view will show ATT&CK coverage, when only the dedicated MITRE ATT&CK Dashboard provides that specific mapping.

Practice this question →
22
Multi-Selectmedium

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

Select 3 answers
A.Report
B.Eradicate
C.Detect
D.Protect
E.Identify
AnswersC, D, E

Detect is a NIST CSF Core function covering anomaly detection, continuous monitoring and detection processes. It is one of the five functions explicitly defined in the CSF Core, satisfying the stem's requirement for recognised components.

Why this answer

The NIST Cybersecurity Framework (CSF) Core defines five concurrent and continuous functions: Identify, Protect, Detect, Respond, and Recover. Option E (Identify) is correct because it covers understanding the organization's assets, risks, and governance to prioritize cybersecurity efforts. Option D (Protect) is correct because it encompasses safeguards such as access control, awareness training, and data security to limit or contain the impact of a potential event.

Option C (Detect) is correct because it defines activities to identify the occurrence of a cybersecurity event, including continuous monitoring and anomaly detection. Options A (Report) and B (Eradicate) are not CSF Core functions; they belong to other frameworks or incident-response lifecycles (for example, 'Eradicate' appears in NIST SP 800-61 incident handling, and 'Report' is not one of the five CSF functions).

Exam trap

SPLK-5001 often tests whether candidates confuse CSF Core functions with incident response phases — the trap is selecting 'Eradicate' or 'Report' because they sound like security lifecycle stages.

Practice this question →
23
MCQmedium

A security team wants to align their Splunk Enterprise Security (ES) deployment with the NIST Cybersecurity Framework (CSF) 2.0 to improve governance and risk management. They are specifically focused on the 'Identify' function. Which of the following activities best exemplifies the use of Splunk ES to support the 'Identify' function?

A.Using the Risk Analysis dashboard to prioritize vulnerabilities based on asset criticality and threat intelligence.
B.Using the Asset and Identity framework to maintain an up-to-date inventory of critical systems and their owners.
C.Configuring correlation searches to detect unauthorized access attempts and generate notable events.
D.Implementing automated response actions to isolate infected endpoints upon detection of malware.
AnswerB

The Identify function in NIST CSF 2.0 emphasizes understanding cybersecurity risks to systems, people, assets, data, and capabilities. Splunk ES's Asset and Identity framework allows organizations to centrally manage and correlate asset information, which is fundamental for identifying what needs protection and assessing risk. This directly supports the Identify function by providing a current inventory and context for critical assets.

Why this answer

The Identify function in NIST CSF 2.0 focuses on understanding the cybersecurity risks to systems, people, assets, data, and capabilities. Splunk ES's Asset and Identity framework provides a centralized way to manage and correlate asset information, which is essential for identifying what needs protection and assessing risk. This directly supports the Identify function by maintaining an accurate inventory and context for critical assets, enabling effective governance and risk management.

Exam trap

The trap here is confusing the Identify function with Detect or Respond, where asset inventory is foundational but not the active detection or response itself.

Practice this question →
24
MCQhard

A security analyst is reviewing an incident where an attacker used the technique 'T1071.001 - Application Layer Protocol: Web Protocols' for command and control. The analyst needs to identify which data sources in Splunk ES would be most effective for detecting this activity. Which of the following data sources should be prioritized?

A.Firewall logs and NetFlow data
B.Endpoint detection and response (EDR) telemetry
C.Web proxy logs and DNS logs
D.Authentication logs and Windows Security event logs
AnswerC

Web proxy logs capture HTTP/HTTPS requests and responses, which are the primary protocols used in T1071.001. DNS logs can reveal domain lookups associated with C2 domains. Together, they provide visibility into the web-based communication channels that attackers abuse. Splunk ES can correlate these logs with threat intelligence to detect known malicious domains or anomalous patterns, making them the most relevant data sources for this technique.

Why this answer

Web proxy logs and DNS logs provide the application-layer visibility needed to detect T1071.001, which relies on HTTP/HTTPS for command and control. Proxy logs show the actual web requests, including URLs and user agents, while DNS logs can reveal domain resolutions to known C2 infrastructure. Splunk ES can ingest these sources and apply threat intelligence matching or behavioral analytics to identify malicious web traffic.

Exam trap

The trap here is assuming that network flow data or firewall logs are sufficient to detect application-layer C2, when they lack the necessary protocol details.

Practice this question →
25
Multi-Selecthard

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

Select 2 answers
A.Notable Events framework.
B.Workload Management.
C.Data Model acceleration.
D.Correlation Searches.
E.Report acceleration.
AnswersA, D

The notable events framework aggregates and prioritises alerts produced by correlation searches into an analysable queue, giving analysts the triage visibility the Detect function demands. It satisfies the stem by surfacing suspicious activity requiring investigation, complementing the detection logic itself.

Why this answer

The NIST CSF 'Detect' function requires capabilities to identify the occurrence of cybersecurity events, and in Splunk ES the Notable Events framework (A) is the mechanism that surfaces and tracks those identified events as discrete, reviewable notables for analysts, directly supporting detection visibility. Correlation Searches (D) are the scheduled or real-time detections that evaluate data against rules and generate those notable events, making them the core detection logic that fulfills the Detect function. Workload Management (B) is a resource-scheduling and CPU/IO prioritization feature, not a detection-visibility capability.

Data Model acceleration (C) and Report acceleration (E) are performance optimizations that speed up searches over data models or saved reports, but they do not themselves provide detection visibility or generate security findings.

Exam trap

SPLK-5001 often tests the mapping of Splunk features to NIST CSF functions. Candidates might confuse performance features like Data Model acceleration with detection features, or think that Workload Management provides visibility when it actually manages resources.

Practice this question →
26
MCQeasy

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

A.Sending a spear-phishing email.
B.Encrypting user files for ransom.
C.Installing a backdoor on a web server.
D.Scanning external IP ranges for open ports.
AnswerD

Scanning external IP ranges for open ports is active reconnaissance: the adversary probes target systems to map exposed services before exploitation. This satisfies the Cyber Kill Chain's reconnaissance phase, which covers both passive and active information gathering against the target.

Why this answer

Reconnaissance in the Cyber Kill Chain involves information gathering and scanning to identify potential targets. Scanning external IP ranges for open ports is a classic reconnaissance activity, as it helps attackers map the attack surface. The other options represent later stages: spear-phishing is delivery, encryption for ransom is actions on objectives, and installing a backdoor is installation.

Exam trap

SPLK-5001 often tests the mapping of specific activities to the correct Cyber Kill Chain phase, causing candidates to confuse reconnaissance with delivery or exploitation, especially when activities involve scanning or email.

How to eliminate wrong answers

Option A is wrong because sending a spear-phishing email is part of the Delivery phase, where the attacker delivers the payload to the victim. Option B is wrong because encrypting user files for ransom is part of the Actions on Objectives phase, where the attacker achieves their goal. Option C is wrong because installing a backdoor on a web server is part of the Installation phase, where the attacker establishes persistence.

Practice this question →
27
MCQeasy

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

A.Domain Controller authentication logs.
B.Email gateway logs and web proxy logs.
C.Internal host process creation logs.
D.Endpoint file integrity monitoring.
AnswerB

The Delivery phase covers weaponisation and transmission, where malicious payloads reach the victim. Email gateway and web proxy logs capture delivery vectors such as phishing attachments and drive-by downloads, directly evidencing this stage rather than exploitation or command-and-control.

Why this answer

The Delivery phase of the Cyber Kill Chain covers how the attacker transmits the weaponized payload to the victim — typically via email attachments, malicious links, or drive-by downloads. Email gateway logs capture delivery attempts (attachments, sender reputation, URL clicks), and web proxy logs capture drive-by download and malicious URL access. These two sources are the primary telemetry for correlating alerts to the Delivery stage.

Exam trap

SPLK-5001 often tests whether candidates can map data sources to the correct Kill Chain phase — the trap is choosing endpoint or authentication logs for Delivery when those belong to later phases like Exploitation or Credential Access.

How to eliminate wrong answers

Option A is wrong because Domain Controller authentication logs map to the Credential Access and Lateral Movement phases (e.g., pass-the-hash, Kerberoasting), not Delivery. Option C is wrong because internal host process creation logs correspond to the Exploitation, Installation, and Command and Control phases — process execution happens after delivery. Option D is wrong because endpoint file integrity monitoring detects file changes post-compromise (Installation/Actions on Objectives), not the initial delivery vector.

Practice this question →
28
Multi-Selecthard

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Select 2 answers
A.Configure all logs to use the 'Syslog' protocol only.
B.Enablement of the 'Splunk App for CIS Benchmarks'.
C.Install a third-party antivirus solution.
D.Deployment of the Splunk Universal Forwarder on target endpoints.
E.Configure the index to 'Hot/Warm' storage only.
AnswersB, D

Installing the Splunk App for CIS Benchmarks supplies the prebuilt dashboards, data models and field extractions that map raw CIS-CAT scan output to the Secure Configuration reporting schema. Without it, ingested benchmark results remain unparsed, so the endpoint compliance posture required by the stem cannot be reported.

Why this answer

Option B is correct because the Splunk App for CIS Benchmarks provides the pre-built dashboards, reports, and knowledge objects that map CIS Benchmark controls to Splunk data, which is required to report on Secure Configuration compliance. Option D is correct because the Splunk Universal Forwarder must be deployed on the target endpoints to collect and forward the relevant security configuration data (such as registry, file, and audit settings) to the Splunk indexers for analysis. Option A is incorrect because Splunk can ingest data via multiple protocols (Splunk-to-Splunk, HTTP Event Collector, syslog, etc.), and restricting to syslog only is neither necessary nor sufficient for CIS Benchmark reporting.

Option C is incorrect because a third-party antivirus solution is unrelated to Splunk's CIS Benchmark reporting capability. Option E is incorrect because index storage tiering (Hot/Warm) affects retention and performance, not the ability to report on Secure Configuration.

Exam trap

SPLK-5001 often tests whether candidates conflate 'collecting data' with 'reporting on compliance' — the trap is picking only the forwarder or only the app, when both are required for CIS Benchmark reporting to function.

Practice this question →
29
MCQeasy

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

A.Installation.
B.Command and Control (C2).
C.Reconnaissance.
D.Exploitation.
AnswerB

Egress filtering blocks outbound traffic to attacker-controlled infrastructure, severing the channel established during Command and Control. Since C2 depends on beaconing from the compromised host to external servers, restricting outbound destinations directly disrupts this phase, satisfying the strict egress constraint.

Why this answer

Strict egress filtering on the firewall blocks outbound connections from compromised hosts to attacker-controlled infrastructure, which directly disrupts the Command and Control (C2) phase of the Cyber Kill Chain. Without C2, the attacker cannot issue commands, exfiltrate data, or maintain persistence, making egress filtering one of the most effective C2 mitigations.

Exam trap

SPLK-5001 often tests whether candidates map mitigations to the correct Kill Chain phase — the trap is choosing Exploitation or Installation because they sound like 'where the attack happens,' when egress filtering specifically targets the outbound C2 channel.

How to eliminate wrong answers

Option A (Installation) is wrong because installation occurs on the endpoint itself (malware dropping files, establishing persistence) and is not primarily mitigated by network egress rules — endpoint controls like EDR and application whitelisting are more relevant. Option C (Reconnaissance) is wrong because reconnaissance is the attacker's information-gathering phase (scanning, OSINT) and happens before any internal compromise; egress filtering does not stop external scanning. Option D (Exploitation) is wrong because exploitation is the initial code execution against a vulnerability, which is mitigated by patching and hardening, not by outbound firewall rules.

Practice this question →
30
MCQmedium

A Splunk security analyst is mapping the organization's detection capabilities to the NIST Cybersecurity Framework (CSF) Core functions. The analyst wants to ensure that the team can effectively identify anomalous activity across the enterprise. Which CSF function should the analyst prioritize to meet this objective?

A.Respond
B.Protect
C.Identify
D.Detect
AnswerD

The Detect function in the NIST CSF is defined as developing and implementing appropriate activities to identify the occurrence of a cybersecurity event. This directly aligns with the analyst's goal of identifying anomalous activity. It includes continuous monitoring, detection processes, and anomaly detection, making it the correct CSF function to prioritize for this objective.

Why this answer

The NIST CSF Detect function is specifically designed to identify the occurrence of cybersecurity events through continuous monitoring and anomaly detection. To ensure the team can effectively identify anomalous activity, the analyst should prioritize the Detect function, which encompasses detection processes and technologies like Splunk ES. This function provides the necessary capabilities to discover threats in a timely manner.

Exam trap

The trap here is conflating the Identify function with detection activities; Identify is about understanding assets and risks, not real-time monitoring for anomalies.

Practice this question →
31
MCQhard

A Splunk ES analyst is reviewing an incident where an attacker used a compromised user account to move laterally within the network. The analyst wants to map this activity to the MITRE ATT&CK framework. Which tactic best describes the attacker's actions?

A.Initial Access
B.Lateral Movement
C.Privilege Escalation
D.Execution
AnswerB

Lateral Movement consists of techniques that attackers use to enter and control remote systems on a network. Using a compromised user account to move laterally is a classic example of this tactic. The goal is to reach additional systems and potentially escalate privileges or access sensitive data. This directly matches the scenario, making it the correct tactic.

Why this answer

The MITRE ATT&CK tactic Lateral Movement describes techniques used by attackers to move through a network after gaining initial access. Using a compromised user account to access other systems is a primary example of this tactic. It allows attackers to expand their foothold, access additional resources, and potentially escalate privileges.

Therefore, Lateral Movement is the correct mapping for this activity.

Exam trap

The trap here is confusing Lateral Movement with Privilege Escalation, as both involve expanding access; however, Lateral Movement is about moving between systems, while Privilege Escalation is about gaining higher permissions on a single system.

Practice this question →
32
MCQmedium

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration event. They need to determine which MITRE ATT&CK tactic describes the adversary's objective of stealing data from the compromised network. Which tactic should they reference?

A.Exfiltration
B.Collection
C.Impact
D.Command and Control
AnswerA

Exfiltration is the ATT&CK tactic that describes techniques adversaries use to steal data from your network, such as over command and control channels or via physical media. In Splunk ES, detections for large outbound transfers or unusual DNS queries map to this tactic. Focusing on Exfiltration helps analysts identify and block data loss at the point of egress.

Why this answer

Exfiltration is the correct ATT&CK tactic for data theft. It encompasses techniques like exfiltration over C2 channel, exfiltration over alternative protocol, and exfiltration over physical medium. In Splunk ES, analysts should look for correlation searches that detect anomalous outbound data volumes or connections to known malicious IPs, and ensure these are tagged with the Exfiltration tactic for accurate reporting.

Exam trap

The trap here is equating the objective of stealing data with Command and Control, but C2 is about communication, not the actual data theft.

Practice this question →
33
MCQmedium

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

A.The 'Network Resolution' Data Model.
B.The 'Vulnerability' Data Model.
C.The 'Authentication' Data Model.
D.The 'Malware' Data Model.
AnswerC

Lateral movement detection relies on authentication events, since attackers pivoting between hosts generate logon activity across systems. The Authentication Data Model normalises these events, so populating and enabling it gives the correlation searches the data required to surface lateral movement in Splunk ES.

Why this answer

Lateral movement in MITRE ATT&CK involves an adversary moving from one host to another, which is detected in Splunk ES primarily through authentication activity — logons, remote service creation, and credential use across systems. The Authentication data model normalizes logon/logoff, privilege escalation, and related events, and ES correlation searches for lateral movement (e.g., 'Detect Lateral Movement' or 'Excessive Authentication Failures') rely on it. Without the Authentication data model populated and accelerated, those detections cannot fire.

Exam trap

SPLK-5001 often tests which CIM data model maps to a given ATT&CK tactic; candidates confuse Malware or Network Resolution with Authentication, missing that lateral movement is fundamentally an authentication/remote-access behavior.

How to eliminate wrong answers

Option A is wrong because the Network Resolution data model maps IP addresses to hostnames and enriches network traffic; it supports DNS/network context, not authentication-based lateral movement detection. Option B is wrong because the Vulnerability data model tracks vulnerability scan findings and CVEs on assets; it is used for risk and patch management, not for detecting adversary movement between hosts. Option D is wrong because the Malware data model normalizes antivirus/endpoint malware detections and file/process artifacts; while useful for endpoint compromise, it does not capture the authentication and remote-access events that define lateral movement.

Practice this question →
34
MCQmedium

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

A.Vulnerability Data Model.
B.Assets and Identity Data Model.
C.Endpoint Data Model.
D.Network Traffic Data Model.
AnswerB

The Assets and Identity Data Model normalises asset inventory fields such as hostnames, IP addresses and ownership, which the CIS Control 1 requirement for tracking enterprise assets depends on. It is the only model providing that asset-centric visibility for Splunk searches.

Why this answer

The Assets and Identity Data Model is the Splunk Common Information Model (CIM) data model that normalizes asset inventory and identity information — hostnames, IPs, MAC addresses, OS details, and user identities. CIS Control 1 (Inventory and Control of Enterprise Assets) requires knowing every device on the network, and this data model is purpose-built to provide that visibility. It is the essential model for tracking enterprise assets in Splunk.

Exam trap

SPLK-5001 often tests whether candidates conflate the Assets and Identity Data Model (inventory) with the Endpoint or Vulnerability Data Models (behavior/findings) — remember Control 1 is about knowing what exists, not what's wrong with it.

How to eliminate wrong answers

Option A is wrong because the Vulnerability Data Model tracks CVEs and vulnerability scan findings against assets — it presupposes you already know your assets and addresses CIS Control 7 (Continuous Vulnerability Management), not Control 1. Option C is wrong because the Endpoint Data Model captures process, file, registry, and service activity on endpoints — it's about endpoint behavior telemetry, not asset inventory. Option D is wrong because the Network Traffic Data Model normalizes flow data (src/dest, bytes, ports) for traffic analysis, which supports network monitoring controls but does not enumerate enterprise assets.

Practice this question →
35
MCQeasy

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the "Command and Control" phase. Which of the following data sources would be most relevant for detecting command and control communications?

A.Endpoint process execution logs
B.Authentication logs
C.Email gateway logs
D.Firewall logs
AnswerD

Firewall logs record network connections, including source and destination IP addresses, ports, and protocols. Command and control (C2) communications often involve outbound connections to malicious servers. By analyzing firewall logs for unusual destinations or beaconing patterns, analysts can detect C2 activity. Therefore, firewall logs are a primary data source for identifying C2 communications in the Cyber Kill Chain.

Why this answer

Command and Control (C2) communications involve compromised hosts communicating with attacker-controlled infrastructure. Firewall logs provide visibility into network connections, including outbound traffic, which is essential for detecting C2 channels. By analyzing firewall logs for suspicious destinations, unusual ports, or beaconing behavior, analysts can identify C2 activity.

Other data sources like endpoint or authentication logs may provide context but are not as directly relevant for network-based C2 detection.

Exam trap

The trap here is focusing on endpoint data for a network-centric phase, overlooking that C2 is primarily about network communications.

Practice this question →
36
Multi-Selectmedium

You are aligning your Splunk ES deployment with the NIST Cybersecurity Framework (CSF) to improve your organization's security posture. The CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Which TWO of the following Splunk ES capabilities most directly support the 'Respond' function? (Choose two.)

Select 2 answers
A.Incident review and collaboration tools
B.Asset and identity correlation for context enrichment
C.Threat intelligence framework for ingesting indicators
D.Adaptive response actions to automatically block IPs
E.Risk analysis dashboard for prioritizing vulnerabilities
AnswersA, D

The Respond function includes activities to take action regarding a detected cybersecurity event. Splunk ES's incident review and collaboration tools allow analysts to triage, investigate, and coordinate response efforts. Features like the incident review dashboard, commenting, and assignment of investigations directly support the Respond function by enabling efficient incident handling and communication among team members.

Why this answer

The Respond function of the NIST CSF focuses on taking action after a security event is detected. Splunk ES's incident review and collaboration tools facilitate investigation and coordination, while adaptive response actions enable automated containment and mitigation. Together, these capabilities directly support the Respond function by streamlining incident handling and executing response measures.

Exam trap

The trap here is assuming that threat intelligence or risk analysis directly support Respond, when they primarily enable Detect and Identify functions.

Practice this question →
37
MCQmedium

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

A.Splunk Add-on for Linux Auditd.
B.Splunk App for Infrastructure (SAI).
C.Splunk App for CIS Benchmarks.
D.Splunk Enterprise Security Vulnerability Scanner.
AnswerC

The Splunk App for CIS Benchmarks provides prebuilt dashboards, data models and correlation searches that ingest CIS-CAT assessment output and report pass/fail per control, directly satisfying the requirement to ingest and report Linux CIS compliance checks without custom field extraction or search development.

Why this answer

The Splunk App for CIS Benchmarks is the standard tool for ingesting and reporting CIS Benchmark compliance checks in Splunk. It provides pre-built dashboards, reports, and data models specifically for CIS compliance monitoring across various platforms, including Linux.

Exam trap

SPLK-5001 often tests which Splunk app is used for specific compliance frameworks — candidates may confuse the CIS Benchmarks app with the Linux Auditd add-on or the Infrastructure app, which serve different purposes.

How to eliminate wrong answers

Option A is wrong because the Splunk Add-on for Linux Auditd is used to collect auditd logs, not specifically for CIS Benchmark reporting. Option B is wrong because the Splunk App for Infrastructure (SAI) is for infrastructure monitoring and metrics, not CIS compliance. Option D is wrong because there is no standard 'Splunk Enterprise Security Vulnerability Scanner' app; ES is a SIEM, not a CIS benchmark scanner.

Practice this question →
38
MCQhard

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

A.Index-time field extraction.
B.Correlation search thresholding.
C.Dynamic Threat Intelligence updates.
D.Asset and Identity framework using lookup tables.
AnswerD

The Asset and Identity framework ingests lookup tables to maintain an authoritative, current inventory of authorised software and associated assets. Within the Identify function, this supports asset management and governance by keeping the software list accurate and queryable.

Why this answer

The Asset and Identity framework in Splunk ES uses lookup tables to maintain authoritative records of assets (hardware, software, systems) and identities (users). For maintaining a current list of authorized software, the asset lookup table can include software inventory fields, and the framework supports scheduled updates from external sources. This aligns with the NIST CSF Identify function's goal of maintaining an inventory of authorized software (ID.AM-2).

Exam trap

SPLK-5001 often tests the mapping of Splunk ES features to NIST CSF functions — candidates confuse detection-oriented features (correlation searches, threat intel) with Identify-function capabilities (asset and identity management) because both are part of the ES platform.

How to eliminate wrong answers

Option A is wrong because index-time field extraction is a data parsing technique that extracts fields as data is indexed — it does not maintain a list of authorized software or support the asset management use case. Option B is wrong because correlation search thresholding is used to trigger alerts when event counts exceed a threshold — it is a detection mechanism, not an inventory management tool. Option C is wrong because Dynamic Threat Intelligence updates are used to ingest threat feeds for detection — they are relevant to the Detect function, not the Identify function's asset management requirements.

Practice this question →
39
MCQmedium

You are a security analyst using Splunk Enterprise Security (ES) to map detections to the MITRE ATT&CK framework. Your CISO wants to understand which ATT&CK tactic is most directly addressed by the correlation search that detects suspicious PowerShell execution with encoded commands (T1059.001). Under which ATT&CK tactic should you classify this detection?

A.Persistence
B.Defense Evasion
C.Execution
D.Initial Access
AnswerC

This detection focuses on the actual running of malicious code via PowerShell, which falls under the Execution tactic. MITRE ATT&CK defines Execution as techniques that result in adversary-controlled code running on a local or remote system. Encoded PowerShell commands are a classic example of T1059.001, and Splunk ES maps such detections to Execution to help analysts understand the adversary's operational phase.

Why this answer

The detection of suspicious PowerShell execution with encoded commands directly aligns with the Execution tactic, as it signifies adversary-controlled code running on a system. MITRE ATT&CK technique T1059.001 is explicitly categorized under Execution, and Splunk ES uses this mapping to help analysts prioritize and contextualize alerts. Classifying it under other tactics would inaccurately reflect the adversary's current phase.

Exam trap

The trap here is confusing the method of execution (encoded commands) with the tactic of Defense Evasion, when the core action is code execution.

Practice this question →
40
MCQeasy

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

A.Establishing a persistent connection to the attacker.
B.Executing code to take advantage of a vulnerability.
C.Exfiltrating sensitive company data.
D.Gathering information about the target.
AnswerB

Exploitation is the phase where an attacker leverages a discovered weakness by running code or a crafted payload against it, turning a vulnerability into actual access or execution. It follows weaponisation and delivery, and precedes installation, so its defining goal is triggering the flaw to gain a foothold.

Why this answer

The Exploitation phase of the Cyber Kill Chain is when the attacker's weaponized payload triggers the vulnerability and executes code on the victim's system. This is the moment the malicious code runs and takes advantage of a software flaw (e.g., a buffer overflow, deserialization bug, or macro execution). It is distinct from Delivery (transmitting the payload) and Installation (establishing persistence).

Exam trap

SPLK-5001 often tests whether candidates can distinguish Exploitation (code execution against a vulnerability) from Installation (persistence) and C2 (beaconing) — the trap is picking persistence or exfiltration when the question asks about the exploitation moment.

How to eliminate wrong answers

Option A is wrong because establishing a persistent connection to the attacker describes the Command and Control (C2) phase, where the compromised host beacons out to attacker infrastructure. Option C is wrong because exfiltrating sensitive data is the Actions on Objectives phase — the final goal after the attacker has established persistence and C2. Option D is wrong because gathering information about the target is the Reconnaissance phase, which occurs before weaponization and delivery.

Practice this question →
41
MCQmedium

A Splunk ES analyst is investigating an alert for a suspicious PowerShell script execution. The alert is mapped to MITRE ATT&CK technique T1059.001 (PowerShell). To gather more context, the analyst wants to search for related events across multiple data sources. Which Splunk ES feature should they use to pivot from the alert to relevant events?

A.Asset and Identity Framework
B.Incident Review
C.Threat Intelligence Framework
D.Protocol Intelligence
AnswerB

Incident Review in Splunk ES provides a centralized view of notables and allows analysts to drill down into associated events. It enables pivoting to raw events, asset information, and threat intelligence. This is the correct feature for investigating an alert and gathering context from multiple data sources.

Why this answer

Incident Review is the Splunk ES feature that allows analysts to examine notables and pivot to associated events. It provides a drill-down capability to view raw events, asset context, and threat intelligence, enabling comprehensive investigation of an alert. Other features like Threat Intelligence Framework, Asset and Identity Framework, and Protocol Intelligence serve different purposes and do not provide the same pivot functionality.

Exam trap

The trap here is confusing Threat Intelligence Framework with investigation tools; while it provides indicators, it does not allow pivoting from an alert to raw events.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Cyber Landscape And Industry Frameworks questions.

Start 20-question session