SPLK-5001試験無料問題集（144題）「Splunk Certified Cybersecurity Defense Analyst 認定」

出題：1

Which SPL syntax would be used to perform statistical queries on indexed fields to calculate the cumulative total risk by the system or user in the most efficient way?

A. | tstats 'summariesonly' sum(All_Risk.calculated_risk_score) as

B. index=* |stats sum(risk_score) as risk_score count by risk_object

C. risk_score from datamodel=Risk.All_Risk by All_Risk.risk_object

D. index=risk |stats sum(risk_score) as risk_score count by risk_object

E. | from datamodel:"Risk"."All Risk" | table risk_score risk_object

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

While testing the dynamic removal of credit card numbers, an analyst lands on using the rex command. What mode needs to be set to in order to replace the defined values with X?
| makeresults
| eval ccnumber="511388720478619733"
| rex field=ccnumber mode=??? "s/(\d{4}-){3)/XXXX-XXXX-XXXX-/g"
Please assume that the above rex command is correctly written.

A. sed

B. substitute

C. replace

D. mask

正解：A 解答を投票する

出題：3

Which of the following Splunk terms describes a group of standard field names and values that categorize data in a way that makes it easier to work with, especially when dealing with multiple data sources?

A. Field model

B. Threat model

C. Data model

D. Standard model

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

What is the name of the threat-hunting technique that involves identifying data points that are least like the other points in a dataset?

A. Hypothesis checking

B. Stack counting

C. Timeline analysis

D. Anomaly detection

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

An analyst investigates an IDS alert and confirms suspicious traffic to a known malicious IP. What Enterprise Security data model would they use to investigate which process initiated the network connection?

A. Endpoint

B. Network traffic

C. Web

D. Authentication

正解：A 解答を投票する

出題：6

Which of the following use cases is best suited to be a Splunk SOAR Playbook?

A. Creating persistent field extractions.

B. Taking containment action on a compromised host

C. A Forming hypothesis for Threat Hunting

D. Visualizing complex datasets.

正解：B 解答を投票する

出題：7

Which part of the CIA triad is the opposite of destruction of information?

A. Integrity

B. Availability

C. Confidentiality

D. Continuity

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

This cyber framework provides guidance on how to approach cybersecurity related issues based on four main use cases: threat intelligence, detection and analytics, adversary emulation and red teaming, and assessment and engineering. Which framework is this?

A. NIST

B. CIS

C. ISO 27001

D. MITRE ATT&CK

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

Which argument would an analyst use to search only accelerated data contained in the Network Traffic Data Model with the tstatscommand?

A. datamodel=accelerated

B. summariesonly=true

C. accelerated=true

D. dataset=accelerated

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：10

Which of the following data sources can be used to discover unusual communication within an organization's network?

A. Net Flow

B. IAM

C. EDS

D. Email

正解：A 解答を投票する

SPLK-5001試験無料問題集「Splunk Certified Cybersecurity Defense Analyst 認定」