Free SPLK-5001 Sample Questions — Splunk Certified Cybersecurity Defense Analyst

An analysis of an organization’s security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of implementing the new process or solution that was selected?

• A. Security Architect
• B. SOC Manager
• C. Security Engineer
• D. Security Analyst

The following list contains examples of Tactics, Techniques, and Procedures (TTPs): 1. Exploiting a remote service 2. Lateral movement 3. Use EternalBlue to exploit a remote SMB server In which order are they listed below?

• A. Tactic, Technique, Procedure
• B. Procedure, Technique, Tactic
• C. Technique, Tactic, Procedure
• D. Tactic, Procedure, Technique

A user wants to view only the use cases for which the Splunk instance has all of the supporting source types to implement. In Splunk Security Essentials, what operation needs to happen first?

• A. Data Inventory
• B. Analytic Advisor
• C. Data Availability
• D. Content Mapping

An analyst is not sure that all of the potential data sources at her company are being correctly or completely utilized by Splunk and Enterprise Security. Which of the following might she suggest using, in order to perform an analysis of the data types available and some of their potential security uses?

• A. Splunk ITSI
• B. Splunk Security Essentials
• C. Splunk SOAR
• D. Splunk Intelligence Management

Tactics, Techniques, and Procedures (TTPs) are methods or behaviors utilized by attackers. In which framework are these categorized?

• A. NIST 800-53
• B. ISO 27000
• C. CIS18
• D. MITRE ATT&CK