Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Splunk
  5. SPLK-5001

Splunk SPLK-5001 Exam
Splunk Certified Cybersecurity Defense Analyst (Page 2 )

Updated On: 1-Feb-2026
Page 2 of 15
PDF with 131 Questions

Which Enterprise Security framework provides a mechanism for running preconfigured actions within the Splunk platform or integrating with external applications?

  1. Asset and Identity
  2. Notable Event
  3. Threat Intelligence
  4. Adaptive Response

Answer(s): D



The field file_acl contains access controls associated with files affected by an event. In which data model would an analyst find this field?

  1. Malware
  2. Alerts
  3. Vulnerabilities
  4. Endpoint

Answer(s): D



A threat hunter generates a report containing the list of users who have logged in to a particular database during the last 6 months, along with the number of times they have each authenticated. They sort this list and remove any user names who have logged in more than 6 times. The remaining names represent the users who rarely log in, as their activity is more suspicious. The hunter examines each of these rare logins in detail.

This is an example of what type of threat-hunting technique?

  1. Least Frequency of Occurrence Analysis
  2. Co-Occurrence Analysis
  3. Time Series Analysis
  4. Outlier Frequency Analysis

Answer(s): A



What is the main difference between hypothesis-driven and data-driven Threat Hunting?

  1. Data-driven hunts always require more data to search through than hypothesis-driven hunts.
  2. Data-driven hunting tries to uncover activity within an existing data set, hypothesis-driven hunting begins with a potential activity that the hunter thinks may be happening.
  3. Hypothesis-driven hunts are typically executed on newly ingested data sources, while data-driven hunts are not.
  4. Hypothesis-driven hunting tries to uncover activity within an existing data set, data-driven hunting begins with an activity that the hunter thinks may be happening.

Answer(s): B



The Security Operations Center (SOC) manager is interested in creating a new dashboard for typosquatting after a successful campaign against a group of senior executives.
Which existing ES dashboard could be used as a starting point to create a custom dashboard?

  1. IAM Activity
  2. Malware Center
  3. Access Anomalies
  4. New Domain Analysis

Answer(s): D



Viewing page 2 of 15
Viewing questions 6 - 10 out of 131 questions



Post your Comments and Discuss Splunk SPLK-5001 exam prep with other Community members:

Join the SPLK-5001 Discussion