Which of the following is the primary benefit of using the CIM in Splunk?
A
Which of the following data sources would be most useful to determine if a user visited a recently
identified malicious website?
B
Which of the following is a tactic used by attackers, rather than a technique?
A
Enterprise Security has been configured to generate a Notable Event when a user has quickly
authenticated from multiple locations between which travel would be impossible. This would be
considered what kind of an anomaly?
A
An analyst is investigating a network alert for suspected lateral movement from one Windows host
to another Windows host. According to Splunk CIM documentation, the IP address of the host from
which the attacker is moving would be in which field?
D
Which pre-packaged app delivers security content and detections on a regular, ongoing basis for
Enterprise Security and SOAR?
B
A Cyber Threat Intelligence (CTI) team produces a report detailing a specific threat actor’s typical
behaviors and intent. This would be an example of what type of intelligence?
C
In Splunk Enterprise Security, annotations can be added to enrich correlation search results with
security framework mappings. Which of the following security frameworks is not available as a
default annotation option?
B
An analyst learns that several types of data are being ingested into Splunk and Enterprise Security,
and wants to use the metadata SPL command to list them in a search. Which of the following
arguments should she use?
B
While investigating findings in Enterprise Security, an analyst has identified a compromised device.
Without leaving ES, what action could they take to run a sequence of containment activities on the
compromised device that also updates the original finding?
C
Which of the following is a best practice when creating performant searches within Splunk?
C
Which of the following data sources can be used to discover unusual communication within an
organization’s network?
B
A Cyber Threat Intelligence (CTI) team delivers a briefing to the CISO detailing their view of the
threat landscape the organization faces. This is an example of what type of Threat Intelligence?
B
Which of the Enterprise Security frameworks provides additional automatic context and correlation
to fields that exist within raw data?
D
An analyst needs to create a new field at search time. Which Splunk command will dynamically
extract additional fields as part of a Search pipeline?
A