Question 1

A threat hunter generates a report containing the list of users who have logged in to a particular database during the last 6 months, along with the number of times they have each authenticated. They sort this list and remove any user names who have logged in more than 6 times. The remaining names represent the users who rarely log in, as their activity is more suspicious. The hunter examines each of these rare logins in detail. This is an example of what type of threat-hunting technique?

Options :

A : Least Frequency of Occurrence Analysis

B : Co-Occurrence Analysis

C : Time Series Analysis

D : Outlier Frequency Analysis

Answer: A

Question 2

Which of the following are common built-in dashboards in Splunk Enterprise Security?

Options :

A : User Activity

B : Compliance Overview

C : Threat Intelligence

D : Network Traffic Analysis

E : Asset Investigator

F : Incident Review

Answer: A,E

Question 3

Which of the following are examples of common cyber defense systems?

Options :

A : Network Firewalls

B : Security Information and Event Management (SIEM)

C : Customer Relationship Management (CRM)

D : Endpoint Protection Platforms (EPP)

E : Intrusion Detection Systems (IDS)

F : Data Loss Prevention (DLP)

Answer: A,B,D,E

Question 4

What is the purpose of the CIM (Common Information Model) in Splunk?

Options :

A : To automate security incident response

B : To encrypt sensitive information in logs

C : To provide a standard framework for organizing and normalizing data

D : To generate visualizations for data analysis

Answer: C

Question 5

What are common tiers of Threat Intelligence?

Options :

A : Tactical

B : Technical

C : Operational

D : Strategic

E : Analytical

F : Tactical

Answer: C,D,F

Free SPLK-5001 Mock Exam – Practice Online Confidently

Buying Options: