検証済みSPLK-5001問題集PDF資料 [2024]
最新のSPLK-5001実際の無料試験問題更新された68問あります
Splunk SPLK-5001 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 20
When searching in Splunk, which of the following SPL commands can be used to run a subsearch across every field in a wildcard field list?
- A. transaction
- B. makeresults
- C. foreach
- D. rex
正解：C
質問 # 21
Which of the following is a tactic used by attackers, rather than a technique?
- A. Establishing persistence with a scheduled task.
- B. Escalating privileges via UAC bypass.
- C. Gathering information about a target.
- D. Using a phishing email to gain initial access.
正解：C
質問 # 22
A Cyber Threat Intelligence (CTI) team delivers a briefing to the CISO detailing their view of the threat landscape the organization faces. This is an example of what type of Threat Intelligence?
- A. Tactical
- B. Operational
- C. Strategic
- D. Executive
正解：C
質問 # 23
Which field is automatically added to search results when assets are properly defined and enabled in Splunk Enterprise Security?
- A. asset_category
- B. src_category
- C. src_ip
- D. user
正解：B
質問 # 24
Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server's access log has the same log entry millions of times:
147.186.119.200 - - [28/Jul/2023:12:04:13 -0300] "GET /login/ HTTP/1.0" 200 3733 What kind of attack is occurring?
- A. Denial of Service Attack
- B. Cross-Site Scripting Attack
- C. Distributed Denial of Service Attack
- D. Database Injection Attack
正解：C
質問 # 25
An analysis of an organization's security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of designing the new process and selecting the required tools to implement it?
- A. Security Engineer
- B. SOC Manager
- C. Security Analyst
- D. Security Architect
正解：D
質問 # 26
The Security Operations Center (SOC) manager is interested in creating a new dashboard for typosquatting after a successful campaign against a group of senior executives. Which existing ES dashboard could be used as a starting point to create a custom dashboard?
- A. New Domain Analysis
- B. Malware Center
- C. Access Anomalies
- D. IAM Activity
正解：A
質問 # 27
The United States Department of Defense (DoD) requires all government contractors to provide adequate security safeguards referenced in National Institute of Standards and Technology (NIST) 800-171. All DoD contractors must continually reassess, monitor, and track compliance to be able to do business with the US government.
Which feature of Splunk Enterprise Security provides an analyst context for the correlation search mapping to the specific NIST guidelines?
- A. Framework mapping
- B. Annotations
- C. Comments
- D. Moles
正解：A
質問 # 28
The eval SPL expression supports many types of functions. Which of these function categories is not valid with eval?
- A. JSON functions
- B. Threat functions
- C. Comparison and Conditional functions
- D. Text functions
正解：B
質問 # 29
Which of the following is a correct Splunk search that will return results in the most performant way?
- A. index=foo host=i-478619733 | stats range(_time) as duration by src_ip | bin duration span=5min | stats count by duration, host
- B. index=foo host=i-478619733 | transaction src_ip |stats count by host
- C. | stats range(_time) as duration by src_ip | index=foo host=i-478619733 | bin duration span=5min | stats count by duration, host
- D. index=foo | transaction src_ip |stats count by host | search host=i-478619733
正解：A
質問 # 30
An analyst is building a search to examine Windows XML Event Logs, but the initial search is not returning any extracted fields. Based on the above image, what is the most likely cause?
- A. The analyst did not add the excract command to their search pipeline.
- B. The analyst does not have the proper role to search this data.
- C. The analyst is searching newly indexed data that was improperly parsed.
- D. The analyst is not in the Drooer Search Mode and should switch to Smart or Verbose.
正解：A
質問 # 31
Which of the Enterprise Security frameworks provides additional automatic context and correlation to fields that exist within raw data?
- A. Adaptive Response
- B. Risk
- C. Asset and Identity
- D. Threat Intelligence
正解：C
質問 # 32
During their shift, an analyst receives an alert about an executable being run from C:\Windows\Temp. Why should this be investigated further?
- A. Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions.
- B. Temp directories contain the system page file and the virtual memory file, meaning the attacker can use their malware to read the in memory values of running programs.
- C. Temp directories are flagged as non-executable, meaning that no files stored within can be executed, and this executable was run from that directory.
- D. Temp directories aren't owned by any particular user, making it difficult to track the process owner when files are executed.
正解：A
質問 # 33
While testing the dynamic removal of credit card numbers, an analyst lands on using the rex command. What mode needs to be set to in order to replace the defined values with X?
| makeresults
| eval ccnumber="511388720478619733"
| rex field=ccnumber mode=??? "s/(\d{4}-){3)/XXXX-XXXX-XXXX-/g"
Please assume that the above rex command is correctly written.
- A. mask
- B. substitute
- C. sed
- D. replace
正解：C
質問 # 34
An analysis of an organization's security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of implementing the new process or solution that was selected?
- A. Security Engineer
- B. Security Architect
- C. SOC Manager
- D. Security Analyst
正解：A
質問 # 35
What device typically sits at a network perimeter to detect command and control and other potentially suspicious traffic?
- A. Web proxy
- B. Endpoint Detection and Response
- C. Host-based firewall
- D. Intrusion Detection System
正解：D
質問 # 36
Which of the following is considered Personal Data under GDPR?
- A. The birth date of an unidentified user.
- B. A company's registration number.
- C. The name of a deceased individual.
- D. An individual's address including their first and last name.
正解：D
質問 # 37
A Risk Rule generates events on Suspicious Cloud Share Activity and regularly contributes to confirmed incidents from Risk Notables. An analyst realizes the raw logs these events are generated from contain information which helps them determine what might be malicious.
What should they ask their engineer for to make their analysis easier?
- A. Create a field extraction for this information.
- B. Add this information to the risk message.
- C. Allowlist more events based on this information.
- D. Create another detection for this information.
正解：A
質問 # 38
What is the main difference between hypothesis-driven and data-driven Threat Hunting?
- A. Hypothesis-driven hunting tries to uncover activity within an existing data set, data-driven hunting begins with an activity that the hunter thinks may be happening.
- B. Hypothesis-driven hunts are typically executed on newly ingested data sources, while data-driven hunts are not.
- C. Data-driven hunts always require more data to search through than hypothesis-driven hunts.
- D. Data-driven hunting tries to uncover activity within an existing data set, hypothesis-driven hunting begins with a potential activity that the hunter thinks may be happening.
正解：D
質問 # 39
......
SPLK-5001認定概要最新のSPLK-5001PDF問題集はこちら：https://www.passtest.jp/Splunk/SPLK-5001-shiken.html
無料SPLK-5001試験ブレーン問題集認定ガイド問題と解答：https://drive.google.com/open?id=1P1emdNtlXWNzj2RFC23kNoQDPURhM5lD