SPLK-5001 Practice Test

SPLK-5001 Practice Test practice questions, page 3 of 6, with answer review and explanations.

Question 11

A Risk Rule generates events on Suspicious Cloud Share Activity and regularly contributes to confirmed incidents from Risk Notables. An analyst realizes the raw logs these events are generated from contain information which helps them determine what might be malicious. What should they ask their engineer for to make their analysis easier?

  1. Create a field extraction for this information.
  2. Add this information to the risk_message.
  3. Create another detection for this information.
  4. Allowlist more events based on this information.

Question 12

What device typically sits at a network perimeter to detect command and control and other potentially suspicious traffic?

  1. Host-based firewall
  2. Web proxy
  3. Endpoint Detection and Response
  4. Intrusion Detection System

Question 13

Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server’s access log has the same log entry millions of times: 147.186.119.200 - - [28/Jul/2023:12:04:13 -0300] "GET /login/ HTTP/1.0" 200 3733 What kind of attack is occurring?

  1. Denial of Service Attack
  2. Distributed Denial of Service Attack
  3. Cross-Site Scripting Attack
  4. Database Injection Attack

Question 14

According to David Bianco's Pyramid of Pain, which indicator type is least effective when used in continuous monitoring?

  1. Domain names
  2. TTPs
  3. Network/Host artifacts
  4. Hash values

Question 15

An analysis of an organization’s security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of implementing the new process or solution that was selected?

  1. Security Architect
  2. SOC Manager
  3. Security Engineer
  4. Security Analyst