An adversary uses "LoudMiner” to hijack resources for crypto mining. What does this represent in a TTP framework?
Answer(s): C
In the TTP framework (Tactics, Techniques, and Procedures), a procedure refers to the specific implementation of a technique. “LoudMiner” is an actual malware tool used by adversaries to carry out resource hijacking for crypto mining. This makes it a procedure, since it is the concrete way the broader technique of resource hijacking is executed.
Which of the Enterprise Security frameworks provides additional automatic context and correlation to fields that exist within raw data?
Answer(s): A
https://www.splunk.com/en_us/blog/security/asset-identity-for-splunk-enterprise-security-part-1-con textualizing-systems.html
Which dashboard in Enterprise Security would an analyst use to generate a report on users who are currently on a watchlist?
Answer(s): B
The Identity Tracker dashboard in Splunk Enterprise Security lists users currently on watchlists, letting analysts quickly report on their status and activity.
An analyst needs to send notification emails after investigating a particular type of finding. Which feature should they ask an engineer to enable that will allow them to do so directly from Splunk ES?
By enabling an Adaptive Response Action for email in Splunk ES, analysts can trigger and send notification emails directly from the Incident Review workflow once they’ve investigated a notable finding.
Storing log checksums in a public blockchain system is most closely linked to which security concept?
Answer(s): D
Storing log checksums in a public blockchain ensures that logs cannot be altered without detection. This directly supports Integrity, as the blockchain provides an immutable record that validates the authenticity and completeness of the logs.
Post your Comments and Discuss Splunk SPLK-5001 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-5001 content, but please register or login to continue.