Free SPLK-5002 Questions for Splunk Certified Cybersecurity Defense Engineer SPLK-5002 Exam as PDF & Practice Test Engine
During a ransomware attack, an adversary might add a default user and password in registry, modify the wallpaper, and create bulk ransomware notes across multiple machines. What is Splunk's method for grouping these types of detections together?
Correct Answer: A
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Which phase of the incident response lifecycle would cause the least amount of friction when replacing manual steps with automation?
Correct Answer: C
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
What can an engineer use to capture contextual values from a dashboard and create a drilldown to link to a new search?
Correct Answer: D
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
A SOC's Incident Response Standard Operating Procedure (SOP) calls for any phishing emails containing files to be detonated in Splunk Attack Analyzer for evaluation. Which of the following can an engineer implement to gain efficiency through automation?
Correct Answer: D
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
A company wants to implement risk-based detection for privileged account activities. What should they configure first?
Correct Answer: C
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Based on a recent red team exercise, an organization is highly concerned about pass the hash attacks especially including tools like Empire. Which Eventcode associated to PowerShell Script Block Logging would be used to detect this activity?
Correct Answer: B
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
What must be configured as a setting in a correlation search for a notable to be generated?
Correct Answer: A
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Utilizing a Standard Operating Procedure (SOP) is an effective way to ensure that analysts are responding to generated findings in a consistent and analytical manner. Where is the best place within the Notable Adaptive Response Action to include a link to an SOP?
Correct Answer: C
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
Which field in the risk index is used to describe the activity within a finding?
Correct Answer: D
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
In a Risk-Based Alerting implementation with Splunk Enterprise Security, which of the following best describes a risk factor?
Correct Answer: B
Vote an answer
Explanation: Only visible for ExamDiscuss members. You can sign-up / login (it's free).
0
0
0
10