SPLK-5002

SPLK-5002 practice questions, page 4 of 4, with answer review and explanations.

Question 16

Which Splunk Enterprise Security add-on facilitates the ingestion of Threat Intelligence data?

  1. TA-ThreatIntel
  2. SA-ESSIntel
  3. ESS-Intel
  4. SA-ThreatIntelligence

Question 17

In a Risk-Based Alerting implementation with Splunk Enterprise Security, which of the following best describes a risk factor?

  1. A SOAR action that is drawn from annotations.
  2. A multiplier of risk that depends on the characteristics of the specific user or asset.
  3. A tool to enable risk data model acceleration.
  4. An event that modifies risk based on the characteristics of the specific user or asset.

Question 18

In a contextualization playbook, a URL is transmitted to a sandbox for examination and disposition recommendation. What underlying HTTP method is used to transmit this data to the sandbox?

  1. PUT
  2. POST
  3. GET
  4. STOR

Question 19

What provides consistency for data mapping applied to data model and saved search exports between Splunk Enterprise Security and Splunk SOAR?

  1. Global field aliases
  2. Global field mappings
  3. Field labels
  4. Field aliases

Question 20

Which tool can help provide a baseline of the data sources in a given Splunk environment?

  1. Enterprise Security Content Update
  2. Enterprise Security Data Library
  3. Splunk Security Essentials Analytic Stories
  4. Splunk Security Essentials Data Inventory