SPLK-5002

SPLK-5002 practice questions, page 3 of 4, with answer review and explanations.

Question 11

When developing security metrics, why would a Key Performance Indicator (KPI) that focuses on total perimeter firewall blocks be an ineffective metric?

  1. This a Key Result Indicator, not a KPI. It is a metric that is measuring the results of the perimeter firewall's actions, not the performance of the firewall.
  2. Perimeter firewalls are exposed on the internet directly and thus subject to automated scanners and attack tools.
  3. The metric is too high level, it should be broken down by the type of block. For example, blocks of remote systems that have repeated failed connections to services that do not exist.
  4. Perimeter firewalls should be measured on both the number of connections that they permit as well as the number they block.

Question 12

Which stash event field created by an adaptive response action allows for troubleshooting the correlation search that created the notable event?

  1. search_sid
  2. search_rid
  3. orig_sid
  4. orig_rid

Question 13

An engineer needs to create a new report capturing the vendors and products that detect a particular CVE in their environment. How can they ensure that their search associated with the report only includes accelerated data?

  1. Search for the vendor_product within the Vulnerabilities data model, using the | tstats command.
  2. Search for the cve within the Vulnerabilities data model, using | tstats grouped by vendor_product with summariesonly=true.
  3. Search for the vendor_product within the Updates data model, using the | tstats command.
  4. Search for the vendor_product within the Updates data model, using | tstats grouped by eve with summariesonly=true.

Question 14

What field is used by default to direct data into CIM data model datasets?

  1. sourcetype
  2. tag
  3. dataset
  4. source

Question 15

An engineer receives a report that the "Traffic over time by action" dashboard is not populating. It has been confirmed that the relevant logs are being ingested properly and they are CIM compliant.What other configuration may be missing?

  1. The Performance data model is missing the network dataset.
  2. The Network Traffic data model should be accelerated.
  3. The Network Sessions data model has been deleted.
  4. The Network Sessions data model should be accelerated.