39 questions · Threat And Attack Types topic · All types, answers revealed
An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?
The Endpoint data model captures execution of tools, making it the primary tool for detection.
Why this answer
The Endpoint data model captures process execution, which is the primary indicator of living-off-the-land techniques.
An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?
The file_hash field allows for immediate investigation into file reputation.
Why this answer
The file_hash field is the standard normalized field in Splunk ES for tracking file identities across data sources.
You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?
The Risk Analysis dashboard shows historical risk progression for users and assets.
Why this answer
The 'Risk Analysis' dashboard displays the risk score trend for entities over time.
Which THREE of the following data sources are most valuable for detecting an insider threat?
Tracks sensitive data access.
Why this answer
Insider threats are best monitored through access logs, file activity, and email traffic.
A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?
This dashboard aggregates user-specific behavior including login history.
Why this answer
The User Activity dashboard or the Authentication data model is designed to show user-specific login trends.
You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?
The framework allows you to ingest lists of known malicious IPs and match them against logs.
Why this answer
Threat Intelligence Framework allows for the ingestion of threat intelligence lists like TOR exit nodes.
What is the primary function of the 'Incident Review' dashboard in Splunk ES?
It is the central point for triage and investigation of notable events.
Why this answer
Incident Review is the command center for investigating, assigning, and status-tracking notable events.
You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?
Contains the network connection data required to investigate external communications.
Why this answer
The Network Traffic data model contains information about network connections, including source/destination IP, port, and protocol.
Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?
This is the tool used to create custom security logic.
Why this answer
The Correlation Search editor allows users to define custom search logic against threat intelligence lists.
An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?
Endpoint data is required to map process names to their file paths.
Why this answer
The Endpoint data model contains the 'process_path' and 'process_name' fields required for this comparison.
An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?
Event ID 4624 records successful logins, which is key for identifying pass-the-hash.
Why this answer
Event ID 4624 with Logon Type 3 (Network) or 9 (NewCredentials) is often associated with pass-the-hash attacks.
Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?
This allows you to modify the alert action, including the risk score assigned.
Why this answer
The 'Correlation Search' settings allow for modifying the risk score assigned to notable events.
Which THREE of the following components are part of the 'Endpoint' data model?
Tracks commands and process execution.
Why this answer
The Endpoint data model encompasses file activity, process execution, and registry changes.
You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?
Risk Analysis aggregates risk events for entities, which is perfect for long-term insider threat tracking.
Why this answer
Risk-Based Alerting (RBA) or Risk Analysis allows for aggregating risk scores over time for entities.
Which THREE of the following are common indicators that a host has been infected with malware?
Common for C2 communication.
Why this answer
Malware often creates outbound connections, changes system files, and executes unauthorized processes.
You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?
This dashboard displays traffic origins on a map, which is useful for threat hunting.
Why this answer
The 'Geographic Information' dashboard in Splunk ES maps IP addresses to geographic locations.
Which TWO of the following are common types of social engineering?
A manipulative social engineering technique.
Why this answer
Phishing and pretexting are classic examples of social engineering techniques.
An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?
The Endpoint data model logs process names and command-line arguments.
Why this answer
The Endpoint data model captures process command-line arguments where PowerShell activity resides.
Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?
This provides a second opinion from trusted repositories.
Why this answer
Checking against threat intelligence and using online reputation services are standard methods.
Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?
Incident Review is the main dashboard for triaging and investigating notable events.
Why this answer
The Incident Review dashboard is the primary interface for SOC analysts to manage active notable events.
A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?
Threat Intel provides the framework to match incoming traffic against known malicious phishing URLs.
Why this answer
Threat Intelligence provides the infrastructure to ingest and correlate malicious URLs from phishing campaigns.
Which TWO of the following are examples of reconnaissance techniques used by attackers?
Collecting information about a target's infrastructure.
Why this answer
Port scanning and domain footprinting are common reconnaissance activities.
Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?
RBA helps track user behavior over time.
Why this answer
Implementing RBA and using correlation searches are effective ways to proactively detect and block insider threats.
You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?
tstats is the most efficient way to query indexed data models for volume analysis.
Why this answer
Using 'tstats' on the Network Traffic data model with 'count' grouped by time is the most efficient way to detect volume anomalies.
You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?
The Web data model is specific for HTTP/HTTPS metadata.
Why this answer
The 'Web' data model captures detailed information about web server traffic, including user-agents.
A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?
This dashboard specifically aggregates authentication data to highlight brute-force patterns.
Why this answer
The Access Anomalies dashboard provides a centralized view of authentication-related anomalies.
A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?
This correlation search monitors for suspicious traffic patterns associated with internal movement.
Why this answer
Lateral movement typically involves SMB (port 445) traffic, which is tracked by the 'Lateral Movement' correlation search.
Which THREE of the following fields are required for mapping data to the 'Authentication' CIM data model?
Essential to identify the success or failure.
Why this answer
The Authentication data model requires the user, the status (success/failure), and the action taken.
Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?
Helps detect low-and-slow attacks.
Why this answer
RBA reduces noise, prioritizes high-risk entities, and focuses on behavioral patterns.
An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?
Change Analysis tracks critical system events like clearing the security logs.
Why this answer
The 'Change Analysis' data model tracks significant system changes, including clearing security logs.
Which dashboard provides a summary of all assets categorized by their criticality within the organization?
This dashboard displays asset information including criticality.
Why this answer
The 'Asset Investigator' or 'Security Posture' dashboards provide views of assets based on their identified risk and criticality.
Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?
Critical for configuring external intelligence feeds.
Why this answer
The framework relies on threat sources and the ingestion of indicators into threat intelligence collections.
An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?
Timechart allows the analyst to see the frequency of connections, which helps identify beaconing.
Why this answer
The 'timechart' command is ideal for visualizing events over time to detect periodic patterns indicative of beaconing.
Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?
Malicious links are a core component of phishing.
Why this answer
Phishing often uses suspicious sender domains and malicious embedded links.
An attacker has modified the registry to ensure persistence. Which Splunk ES data model tracks Windows registry changes?
Change Analysis tracks critical system configuration changes, including registry keys.
Why this answer
The 'Change Analysis' data model specifically tracks system configuration changes, including registry modifications.
You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?
This is the specific path to view and manage active threat intelligence feeds.
Why this answer
The Threat Intelligence Uploads page or Data Sources page within the Threat Intelligence framework confirms connectivity.
You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?
The Change Analysis data model is designed to capture configuration and system policy changes.
Why this answer
The Change Analysis data model tracks configuration and policy changes within the environment.
Which THREE of the following data models are critical for monitoring lateral movement within a network?
Required to see cross-system login attempts.
Why this answer
Lateral movement involves network connections, user account usage, and system-level changes.
You need to correlate a VPN login with a subsequent file access on an internal server. Which Splunk ES feature helps you link these disparate events?
Data models normalize data to allow correlation across different technologies.
Why this answer
The 'Common Information Model' (CIM) enables correlation by normalizing fields like 'user' across different data sources.
Ready to test yourself?
Try a timed practice session using only Threat And Attack Types questions.