The United States Department of Defense (DoD) requires all government contractors to provide adequate security safeguards referenced in National Institute of Standards and Technology (NIST) 800-171. All DoD contractors must continually reassess, monitor, and track compliance to be able to do business with the US government.Which feature of Splunk Enterprise Security provides an analyst context for the correlation search mapping to the specific NIST guidelines?
Answer(s): D
https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Configurecorrelationsearches
What is the main difference between a DDoS and a DoS attack?
Answer(s): C
https://www.fortinet.com/resources/cyberglossary/dos-vs-ddos
Which tool can a SOC analyst use to explore existing SPL searches that might be helpful during investigations?
Answer(s): B
Splunk Security Essentials features a built-in Search Library that lets analysts browse and preview hundreds of vetted SPL searches - organized by use case and security domain - so they can quickly find queries relevant to their investigation.
How are Notable Events configured in Splunk Enterprise Security?
https://docs.splunk.com/Documentation/ES/7.3.2/Admin/Createnotablesmanually
An analyst working in Splunk Enterprise Security notices that a configured detection is not being triggered as expected by authentication data coming from a particular source. The detection uses data models to perform a search so they have looked at the data and confirmed it is CIM compliant.What else could be wrong?
Answer(s): A
In Splunk Enterprise Security, data models rely on tags to recognize and categorize events properly. Even if the data is CIM-compliant, if it lacks the authentication tag, the data won't populate the Authentication data model, and detections using that model won’t trigger. Proper tagging is essential for data to be included in the right data model.
Post your Comments and Discuss Splunk SPLK-5001 exam prep with other Community members: