A PCAP file contains what type of data?
Answer(s): D
A PCAP (Packet Capture) file stores raw network packet data as it traverses the network, including full packet headers and payloads.
There are different metrics that can be used to provide insights into SOC operations. If Mean Time to Respond is defined as the total time it takes for an Analyst to disposition an event, what is the typical starting point for calculating this metric for a particular event?
Answer(s): C
Mean Time to Respond (MTTR) typically begins when a Notable Event is triggered in Splunk Enterprise Security. This marks the point at which the SOC becomes aware of a potential issue, initiating the response process. The metric captures how quickly analysts can investigate and resolve the event from that trigger point.
Which part of the CIA triad is the opposite of destruction of information?
Answer(s): B
In the CIA triad, Integrity ensures that information remains accurate, complete, and unaltered. The opposite of destruction or unauthorized modification of information is maintaining its integrity.
Enterprise Security has been configured to generate a Notable Event when a user has quickly authenticated from multiple locations between which travel would be impossible. This would be considered what kind of an anomaly?
“Impossible travel” detections fall under Identity Anomalies in Splunk ES, as they flag unusual or impossible user authentication behavior tied to a specific identity.
Rotating the encryption keys used by a public web server after a security incident is most closely linked to which security concept?
Confidentiality ensures that sensitive information is accessible only to authorized users. Rotating encryption keys helps protect against unauthorized access to data, especially after a security incident, by ensuring that previously compromised keys can no longer be used to decrypt communications.
Post your Comments and Discuss Splunk SPLK-5001 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-5001 content, but please register or login to continue.