QUESTION: 5

A threat hunter executed a hunt based on the following hypothesis:

As an actor, I want to plant rundll32 for proxy execution of malicious code and leverage Cobalt Strike for Command and Control.

Relevant logs and artifacts such as Sysmon, netflow, IDS alerts, and EDR logs were searched, and the hunter is confident in the conclusion that Cobalt Strike is not present in the company's environment.

Which of the following best describes the outcome of this threat hunt?

The threat hunt was successful because the hypothesis was not proven.
The threat hunt failed because the hypothesis was not proven.
The threat hunt failed because no malicious activity was identified.
The threat hunt was successful in providing strong evidence that the tactic and tool is not present in the environment.

Answer(s): D

Reveal Solution Next Question

QUESTION: 6

An analyst notices that one of their servers is sending an unusually large amount of traffic, gigabytes more than normal, to a single system on the Internet. There doesn't seem to be any associated increase in incoming traffic.

What type of threat actor activity might this represent?

Data exfiltration
Network reconnaissance
Data infiltration
Lateral movement

Answer(s): A

Reveal Solution Next Question

QUESTION: 7

In which phase of the Continuous Monitoring cycle are suggestions and improvements typically made?

Define and Predict
Establish and Architect
Analyze and Report
Implement and Collect

Answer(s): C

Reveal Solution Next Question

QUESTION: 8

An analyst is not sure that all of the potential data sources at her company are being correctly or completely utilized by Splunk and Enterprise Security.
Which of the following might she suggest using, in order to perform an analysis of the data types available and some of their potential security uses?

Splunk ITSI
Security Essentials
SOAR
Splunk Intelligence Management

Answer(s): B

Reveal Solution Next Question

Free SPLK-5001 Exam Braindumps (page: 3)

QUESTION: 5

QUESTION: 6

QUESTION: 7

QUESTION: 8

SPLK-5001 Discussions & Posts