Yokoco has contracted with Helpime to perform a penetration test. The scope of the test is all web facing internet applications. Helpime has completed the test and provided its report to Yokoco.What should be done with the unremediated findings of this report?
Answer(s): B
Unremediated penetration test findings represent known security risks that must be formally documented, assigned ownership, prioritized, and tracked through remediation or risk acceptance. Entering them in the risk register ensures they remain visible and managed within the organization’s risk management process.
What data normalization standards should be used to enable a wider integration across Splunk’s security products? (Choose all that apply.)
Answer(s): B,D
OCSF and CIM are data normalization standards that help make security data consistent and reusable across Splunk security products. They support common field naming, event structure, and cross-product integration for searches, detections, dashboards, and analytics.
Kevin is a SOC analyst working with the SRE team to investigate a report of slow responses from a customer-facing web application. While looking at load balancer and WAF logs, Kevin has discovered that one of the web servers hosting the application has gone offline. He does not see any alerts in the WAF or from the endpoint detection and response agent running on the web server.As part of triaging this incident, what should they do next? (Choose all that apply.)
The next triage steps should focus on determining whether the outage was caused by an authorized operational change or by activity on the affected server. Reviewing change management records can identify planned work that may explain the server going offline, while checking system logs and recent logins helps establish what happened on the host and whether further security investigation is needed.
How can an organization best improve its Mean Time to Respond (MTTR) metrics?
SOAR playbooks improve Mean Time to Respond by automating repeatable containment actions, such as isolating infected endpoints. This reduces manual response delays and helps responders act faster when confirmed threats require immediate containment.
Which of the following tasks takes the largest portion of a data scientist’s time?
Data cleaning and preparation typically take the largest portion of a data scientist’s time because raw data must be collected, validated, normalized, enriched, and transformed before reliable analysis or modeling can occur.
Buttercup Games’ incident response team has found IOC’s related to the “Water Curse” campaign within their dev environment. Suspicious activity shows unauthorized access to developer workstations and potential manipulation to their source code in their version control software, GitLow. Given “Water Curse’s” known weaponization of open-source dependencies, a forensic investigation is required to determine the breach’s full scope, identify affected systems, and collect evidence.To support a forensic investigation into the “Water Curse” compromise at Buttercup Games, what triage steps should be performed? (Choose all that apply.)
Answer(s): B,C,D
Forensic triage should preserve evidence and determine the scope of compromise. Reviewing commits and pull requests helps identify possible source code manipulation, collecting volatile memory and disk images preserves host-based evidence, and analyzing network traffic can reveal command-and-control activity and affected systems.
A threat hunter is looking for suspicious login activity across multiple different authentication systems and cloud providers. Today, the threat hunter has to query multiple different data sources with unique logic to gather basic information about authentication events.What method provides a simple way to standardize data formats, and look for common activity across different sources?
Answer(s): D
Data normalization standardizes fields and event structures across different authentication systems and cloud providers. This allows threat hunters to search for common login activity using consistent field names and logic instead of writing separate queries for each unique data source.
A corporation chooses to engage in a Request for Information (RFI) / Request for Proposal (RFP) process.What is a major advantage of this type of formal procurement process?
Answer(s): A
A formal RFI/RFP process helps define requirements in a consistent structure so vendor responses can be evaluated objectively. This makes it easier to compare solutions against the same business, technical, security, operational, and compliance criteria.
Post your Comments and Discuss Splunk SPLK-5003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-5003 content, but please register or login to continue.