Splunk SPLK-5002 - Splunk Certified Cybersecurity Defense Engineer Exam
Page: 1 / 19
Total 91 questions
Question #1 (Topic: Exam A)
Which of the following is a reason to utilize ES risk framework as a part of detection building?
A. Create a feedback loop into threat intelligence to identify potential insider threats.
B. Help accelerate the run time of detections, allowing a faster mean time to detection.
C. Simplify SOAR automation and remediation, lowering the mean time to recover.
D. Help prioritize security findings based on their potential business impact.
Answer: D
Question #2 (Topic: Exam A)
When creating a case in Splunk SOAR, which action should be taken to correlate various findings (risk notables) to ensure all are actioned?
A. Search Splunk Enterprise Security for similar or duplicate events based on the threat_object field in a risk notable.
B. Search Splunk Enterprise Security for all related events based on key fields in a notable and select how to process the results to decide which events to merge into the current investigation.
C. Search Splunk Enterprise Security for similar or duplicate events based on the risk_object field in a risk notable.
D. Search Splunk Enterprise Security for all related events based on key fields in a risk notable and select how to process the results to decide which events to merge into the current investigation.
Answer: D
Question #3 (Topic: Exam A)
Consider the following series of events:
4:00 GMT Detection runs for interval 3:30-4:00
4:30 GMT Detection runs for interval 4:00-4:30
4:35 GMT Event 1 occurs on an endpoint
4:45 GMT Event 1 is indexed
5:00 GMT Detection runs for interval 4:30-5:00
5:05 GMT Event 1 finding is added to ES with timestamp 4:35
5:24 GMT Event 2 occurs on an endpoint
5:30 GMT Detection runs for interval 5:00-5:30
5:35 GMT Event 2 is indexed
6:00 GMT Detection runs for interval 5:30-6:00
What is the problem with the detection schedule chosen and how can it be solved?
4:00 GMT Detection runs for interval 3:30-4:00
4:30 GMT Detection runs for interval 4:00-4:30
4:35 GMT Event 1 occurs on an endpoint
4:45 GMT Event 1 is indexed
5:00 GMT Detection runs for interval 4:30-5:00
5:05 GMT Event 1 finding is added to ES with timestamp 4:35
5:24 GMT Event 2 occurs on an endpoint
5:30 GMT Detection runs for interval 5:00-5:30
5:35 GMT Event 2 is indexed
6:00 GMT Detection runs for interval 5:30-6:00
What is the problem with the detection schedule chosen and how can it be solved?
A. The time window for the detection is too large, causing duplicate alerts.
B. The logs are delayed so the detection time window needs to be increased.
C. The time window for the detection is too small, causing duplicate alerts.
D. The logs are delayed so the detection time window needs to be decreased.
Answer: B
Question #4 (Topic: Exam A)
An effective method for building automation workflows is to follow the OODA (Observe, Orient, Decide, Act) loop stages. When transitioning between the Decide and Act stages, what additional work should be included before automating the Act stage?
A. Create a new response template.
B. Validate if the asset, identity, or service has an exemption.
C. Validate response data paths from Decide stage.
D. Create a new automation playbook.
Answer: B
Question #5 (Topic: Exam A)
What is the best method to operationalize the results of a threat hunt for daily use by SOC analysts?
A. Communicate findings based on the hunt.
B. Create monthly reports based on the documented findings.
C. Create detections based on the documented findings.
D. Communicate gaps to the architecture team.
Answer: C
