Splunk SPLK-5001 Quiz 1 Topic 6 Questions 1-5

Question: 1

An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the alert are not available.

What event disposition should the analyst assign to the Notable Event?

ABenign Positive, since there was no evidence that the event actually occurred.

BFalse Negative, since there are no logs to prove the activity actually occurred.

CTrue Positive, since there are no logs to prove that the event did not occur.

DOther, since a security engineer needs to ingest the required logs.

Show Answer

Question: 2

Which of the following is not a component of the Splunk Security Content library (ESCU, SSE)?

ADashboards

BReports

CCorrelation searches

DValidated architectures

Show Answer

Question: 3

Which of the following is considered Personal Data under GDPR?

AThe birth date of an unidentified user.

BAn individual's address including their first and last name.

CThe name of a deceased individual.

DA company's registration number.

Show Answer

Question: 4

What device typically sits at a network perimeter to detect command and control and other potentially suspicious traffic?

AHost-based firewall

BWeb proxy

CEndpoint Detection and Response

DIntrusion Detection System

Show Answer

Question: 5

Which of the Enterprise Security frameworks provides additional automatic context and correlation to fields that exist within raw data?

AAsset and Identity

BThreat Intelligence

CAdaptive Response

DRisk

Show Answer

Splunk SPLK-5001 Quiz:1 Topic:6 Questions:1-5