Free Splunk SPLK-5001 Exam Dumps Questions & Answers

Which pre-packaged app delivers security content and detections on a regular, ongoing basis for Enterprise Security and SOAR?

• A.ESCU
• B.SSE
• C.Threat Hunting
• D.InfoSec

While investigating findings in Enterprise Security, an analyst has identified a compromised device. Without leaving ES, what action could they take to run a sequence of containment activities on the compromised device that also updates the original finding?

• A.Run an adaptive response action that initiates a SOAR playbook.
• B.Run a field-level workflow action that initiates a SOAR playbook.
• C.Run an event-level workflow action that initiates a SOAR playbook.
• D.Run an alert action that initiates a SOAR playbook.

Which of the following is not considered an Indicator of Compromise (IOC)?

• A.A specific password for a compromised account.
• B.A specific domain that is utilized for phishing.
• C.A specific file hash of a malicious executable.
• D.A specific IP address used in a cyberattack.

A network security tool that continuously monitors a network for malicious activity and takes action to block it is known as which of the following?

• A.Intrusion Detection System
• B.SIEM
• C.Packet Sniffer
• D.Intrusion Prevention System

There are many resources for assisting with SPL and configuration questions. Which of the following resources feature community-sourced answers?

• A.Splunk Guidebook
• B.Splunk Documentation
• C.Splunk Answers
• D.Splunk Lantern