Which of the following data sources would be most useful to determine if a user visited a recently identified malicious website?
Answer(s): B
Web proxy logs capture every user request to external websites, allowing you to see if a user’s browser was directed to the known malicious URL. Proxy logs thus provide direct evidence of web visits, unlike web server logs (which only cover your own servers) or IDS/AD logs.
A network security tool that continuously monitors a network for malicious activity and takes action to block it is known as which of the following?
Answer(s): C
An Intrusion Prevention System (IPS) not only monitors network traffic for malicious activity but also automatically takes action, such as dropping or rejecting packets, to block threats in real time. An IDS, by contrast, only detects and alerts without actively blocking.
While investigating a malware incident, an analyst is unable to determine the host name from the network logs. What feature of Enterprise Security most likely needs to be updated?
Assets & Identities in Splunk Enterprise Security enrich events with contextual information such as host names, IP addresses, and user identities. If an analyst cannot determine the host name from network logs, it likely means the Assets (e.g., IP-to-hostname mappings) are incomplete or outdated and need to be updated.
Which unit of a Security Operations team is focused on collaboration and the integration of defensive tactics and offensive results?
The Purple team is responsible for integrating the efforts of both the Blue team (defensive operations) and the Red team (offensive operations). Their focus is on collaboration, ensuring that insights from offensive testing directly enhance defensive strategies and capabilities.
An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which the attacker is moving would be in which field?
Answer(s): D
https://docs.splunk.com/Documentation/CIM/5.3.2/User/CIMfields
Post your Comments and Discuss Splunk SPLK-5001 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-5001 content, but please register or login to continue.