SPLK-5001 Practice Test

SPLK-5001 Practice Test practice questions, page 5 of 6, with answer review and explanations.

Question 21

The Lockheed Martin Cyber Kill Chain® breaks an attack lifecycle into several stages. A threat actor modified the registry on a compromised Windows system to ensure that their malware would automatically run at boot time. Into which phase of the Kill Chain would this fall?

  1. Act on Objectives
  2. Exploitation
  3. Delivery
  4. Installation

Question 22

A Risk Notable Event has been triggered in Splunk Enterprise Security, an analyst investigates the alert, and determines it is a false positive. What metric would be used to define the time between alert creation and close of the event?

  1. MTTR (Mean Time to Respond)
  2. MTBF (Mean Time Between Failures)
  3. MTTA (Mean Time to Acknowledge)
  4. MTTD (Mean Time to Detect)

Question 23

An analyst needs to create a new field at search time. Which Splunk command will dynamically extract additional fields as part of a Search pipeline?

  1. rex
  2. fields
  3. regex
  4. eval

Question 24

Which of the following is considered Personal Data under GDPR?

  1. The birth date of an unidentified user.
  2. An individual’s address including their first and last name.
  3. The name of a deceased individual.
  4. A company’s registration number.

Question 25

What goal of an Advanced Persistent Threat (APT) group aims to disrupt or damage on behalf of a cause?

  1. Hacktivism
  2. Cyber espionage
  3. Financial gain
  4. Prestige