Free Splunk SPLK-5002 Exam Dumps Questions & Answers

Which search command was used to generate the result in the image below?

• A.datamodel
• B.metadata
• C.cim
• D.datatype

In a contextualization playbook, a URL is transmitted to a sandbox for examination and disposition recommendation. What underlying HTTP method is used to transmit this data to the sandbox?

• A.POST
• B.PUT
• C.STOR
• D.GET

The Director of Security would like to understand the operational efficiency of the SOC analysts at a high level. What is a metric that can be used to determine their efficiency?

• A.MTBR
• B.MTTI
• C.MTTD
• D.MTTR

A Splunk administrator needs to integrate a third-party vulnerability management tool to automate remediation workflows. What is the most efficient first step?

• A.Write a correlation search for each vulnerability type
• B.Set up a manual alerting system for vulnerabilities
• C.Configure custom dashboards to monitor vulnerabilities
• D.Use REST APIs to integrate the third-party tool with Splunk SOAR

A SOC ' s Incident Response Standard Operating Procedure (SOP) calls for any phishing emails containing files to be detonated in Splunk Attack Analyzer for evaluation. Which of the following can an engineer implement to gain efficiency through automation?

• A.Use a SOAR playbook to handle the Splunk Attack Analyzer submission and data-collection steps and make the information available to an assigned analyst.
• B.Use a SOAR playbook to submit the email to PhishTank and have it perform the Splunk Attack Analyzer submission.
• C.Automatically send an email notification for all findings containing the phishing tag.
• D.Automatically assign phishing-tagged findings to analysts to begin manual collection.