SPLK-5002試験無料問題集（119題）「Splunk Certified Cybersecurity Defense Engineer 認定」

出題：1

Risk scores are associated with how many levels of risk in Enterprise Security by default?

A. (5) Info, Low, Medium, High, Critical

B. (6) Info, Low, Medium, High, Critical, Unknown

C. (4) Info, Medium, High, Critical

D. (3) Low, Medium, High

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

An engineer is writing a correlation search and wants to use T1027 from MITRE ATT&CK as a field in Incident Review. Assuming they are writing a correlation search that does not use the Risk data model, what example statement should be appended at the end of their correlation search?

A. | eval field.mitre_attack.mitre_technique_id="T1027"

B. | set field.mitre_attack.mitre_technique_id="T1027"

C. | eval annotations.mitre_attack.mitre_technique_id="T1027"

D. | set annotations.mitre_attack.mitre_technique_id="T1027"

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

What can an engineer use to capture contextual values from a dashboard and create a drilldown to link to a new search?

A. Tokens

B. Aliases

C. Environment variables

D. JSON

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

Which tool can help identify known tactics, techniques, and procedures that a threat group is most likely to use when targeting a financial organization?

A. The MITRE ATT&CK matrix's industry heatmap in Splunk Security Essentials

B. The MITRE ATT&CK Posture panel within Mission Control's Incident Review page

C. The Lockheed Martin Cyber Kill Chain Posture panel within Enterprise Security's Incident Review page

D. Splunk Threat Intelligence Management

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Which of the following is a methodology to help prevent malicious lateral movement?

A. Zero Trust

B. Breakglass

C. Lockheed Martin Cyber Kill Chain

D. MITRE ATT&CK

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

The threat-hunting team has identified suspicious activity. An analyst manually creates a notable event using an event action to track the activity. How should a detection engineer ensure this activity automatically produces findings in the future?

A. Create a SOAR playbook to assign risk modifiers for events matching the activity.

B. Create a correlation search to produce notable events for the activity.

C. Create a SOAR playbook to identify events matching the activity and assign an urgency.

D. Create a risk modifier for events matching the activity.

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

Based on a recent red team exercise, an organization is highly concerned about pass the hash attacks especially including tools like Empire. Which Eventcode associated to PowerShell Script Block Logging would be used to detect this activity?

A. EventCode=4624

B. EventCode=4168

C. EventCode=4104

D. EventCode=4126

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

In Enterprise Security, what is the name of the threat intelligence lookup pertaining to files?

A. file_hash

B. file_intel

C. user_intel

D. user_hash

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

SPLK-5002試験無料問題集「Splunk Certified Cybersecurity Defense Engineer 認定」