Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Splunk
  5. SPLK-5001

Splunk SPLK-5001 Exam
Splunk Certified Cybersecurity Defense Analyst (Page 6 )

Updated On: 1-Feb-2026
Page 3 of 15
PDF with 131 Questions

What is the main difference between a DDoS and a DoS attack?

  1. A DDoS attack is a type of physical attack, while a DoS attack is a type of cyberattack.
  2. A DDoS attack uses a single source to target a single system, while a DoS attack uses multiple sources to target multiple systems.
  3. A DDoS attack uses multiple sources to target a single system, while a DoS attack uses a single source to target a single or multiple systems.
  4. A DDoS attack uses a single source to target multiple systems, while a DoS attack uses multiple sources to target a single system.

Answer(s): C



A Cyber Threat Intelligence (CTI) team delivers a briefing to the CISO detailing their view of the threat landscape the organization faces. This is an example of what type of Threat Intelligence?

  1. Tactical
  2. Strategic
  3. Operational
  4. Executive

Answer(s): B



An analyst is examining the logs for a web application's login form. They see thousands of failed logon attempts using various usernames and passwords. Internet research indicates that these credentials may have been compiled by combining account information from several recent data breaches.

Which type of attack would this be an example of?

  1. Credential sniffing
  2. Password cracking
  3. Password spraying
  4. Credential stuffing

Answer(s): D



An analysis of an organization's security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of designing the new process and selecting the required tools to implement it?

  1. SOC Manager
  2. Security Engineer
  3. Security Architect
  4. Security Analyst

Answer(s): C



After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in another field called machine_name.

What SPL could they use to find all relevant events across either field until the field extraction is fixed?

  1. | eval src = coalesce(src,machine_name)
  2. | eval src = src + machine_name
  3. | eval src = src . machine_name
  4. | eval src = tostring(machine_name)

Answer(s): A



Viewing page 6 of 15
Viewing questions 26 - 30 out of 131 questions



Post your Comments and Discuss Splunk SPLK-5001 exam prep with other Community members:

Join the SPLK-5001 Discussion