Splunk SPLK-5003 - Splunk Certified Cybersecurity Defense Architect Exam
Page: 2 / 24
Total 120 questions
Question #6 (Topic: Exam A)
An architect is planning for a net new SIEM deployment.
Which of the following data sources will provide the most immediate security value?
Which of the following data sources will provide the most immediate security value?
A. Physical access control logs
B. Active Directory logs
C. CMDB logs
D. Security tool alerts
Answer: D
Question #7 (Topic: Exam A)
How can a threat intelligence team discover additional Indicators Of Compromise (IOCs) from threat actor payloads?
A. Submit the payload to Splunk Intelligence Management.
B. Submit the payload to Mission Control.
C. Submit the payload to Behavioral Analytics.
D. Submit the payload to Splunk Attack Analyzer.
Answer: D
Question #8 (Topic: Exam A)
Which of the following is the most direct way to measure a detection engineering practice to understand what gaps may exist in security controls and program effectiveness?
A. Measure Mean Time to Detect (MTTD) threats.
B. Measure the number of true positive security alerts created per environment.
C. Measure security control coverage against industry frameworks and organizational risks.
D. Measure the number of detections created per quarter.
Answer: C
Question #9 (Topic: Exam A)
Buttercup games has implemented over 100 detections in their SOC. These detections consist mostly of vendor provided signatures and field matching that have been tuned, with a few that have been custom built.
What more advanced detection methods should they deploy?
What more advanced detection methods should they deploy?
A. Define breaches of static thresholds
B. Enrich with asset and identity information
C. Use an outlier based algorithm
D. Use automation to pull additional data
Answer: C
Question #10 (Topic: Exam A)
What strategies enable data-driven approaches to evaluating tool efficacy? (Choose all that apply.)
A. Clearly defined outcomes and success criteria
B. Relying on public testimonials and vendor marketing materials
C. Early identification of prioritized requirements and use cases
D. Continuous operational monitoring and metrics collection
Answer: ACD
