An analyst has identified a possible Brute Force Dictionary Attack against several accounts in their directory. What is the MITRE ATT&CK® Tactic associated with this approach?
Answer(s): D
A brute force dictionary attack attempts to gain unauthorized access to accounts by repeatedly trying many possible passwords. In the MITRE ATT&CK® framework, this activity maps to the Credential Access tactic, since the attacker’s objective is to obtain valid account credentials.
In Splunk, what feature would an analyst leverage to drilldown on an IP address field to query third-party intelligence for that IP?
Answer(s): C
Workflow actions let you click on a field value, like an IP address, in search results or dashboards and invoke external lookups or queries (for example, sending the IP to a threat-intel service) directly from the Splunk UI.
Which of the following compliance frameworks was specifically created to measure the level of cybersecurity maturity within an organization?
The Cybersecurity Maturity Model Certification (CMMC) was designed to assess and certify an organization’s cybersecurity maturity across defined levels, ensuring progressive improvement in security practices. Other frameworks like PCI-DSS, GDPR, and FISMA set requirements but do not define graduated maturity levels.
During their shift, an analyst receives an alert about an executable being run from C:\Windows\Temp. Why should this be investigated further?
In Splunk Enterprise Security, annotations can be added to enrich correlation search results with security framework mappings. Which of the following security frameworks is not available as a default annotation option?
In Splunk Enterprise Security, default annotation options for enriching correlation search results include MITRE ATT&CK®, CIS, and the Lockheed Martin Cyber Kill Chain®. OWASP Top 10 is not provided as a default annotation option because it focuses on web application vulnerabilities rather than broader security operations frameworks.
Post your Comments and Discuss Splunk SPLK-5001 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-5001 content, but please register or login to continue.