SPLK-5001問題集、Splunk実際の試験問題

質問 1

Which field is automatically added to search results when assets are properly defined and enabled in Splunk Enterprise Security?

A. src_ip

B. user

C. asset_category

D. src_category

正解: D

質問 2

What is the recommended approach when handling a security incident?

A. Ignore the incident if it seems minor.

B. Follow a pre-defined incident response plan.

C. Rely solely on antivirus software.

D. Take immediate actions based on intuition.

正解: B

質問 3

When should adaptive response actions be used in threat hunting?

A. Adaptive response actions should always be used for any security incident.

B. Adaptive response actions are optional and not necessary for threat hunting.

C. Adaptive response actions should be used to automate responses to security incidents.

D. Adaptive response actions should only be used for low-risk threats.

正解: C

質問 4

Which of the following data sources would be most useful to determine if a user visited a recently identified malicious website?

A. Intrusion Detection Logs

B. Web Server Logs

C. Web Proxy Logs

D. Active Directory Logs

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 5

Which Enterprise Security framework provides a mechanism for running preconfigured actions within the Splunk platform or integrating with external applications?

A. Notable Event

B. Threat Intelligence

C. Adaptive Response

D. Asset and Identity

正解: C

質問 6

The eval SPL expression supports many types of functions. Which of these function categories is not valid with eval?

A. JSON functions

B. Text functions

C. Comparison and Conditional functions

D. Threat functions

正解: D

Splunk Certified Cybersecurity Defense Analyst - SPLK-5001 模擬練習