Free Splunk SPLK-5002 Exam Dumps Questions & Answers

A Splunk administrator needs to integrate a third-party vulnerability management tool to automate remediation workflows. What is the most efficient first step?

• A.Use REST APIs to integrate the third-party tool with Splunk SOAR
• B.Configure custom dashboards to monitor vulnerabilities
• C.Set up a manual alerting system for vulnerabilities
• D.Write a correlation search for each vulnerability type

Which of the following is a methodology to help prevent malicious lateral movement?

• A.Zero Trust
• B.MITRE ATT&CK
• C.Lockheed Martin Cyber Kill Chain
• D.Breakglass

A cyber defense engineer plays a role in maintaining a secure SOAR Cloud configuration. Which network security statement is correct about SOAR Cloud?

• A.The Automation Broker initiates an outbound SSL connection to Splunk Cloud, and also initiates an outbound connection to the managed endpoints.
• B.Splunk Cloud initiates an outbound SSL connection to both the Automation Broker and managed endpoints.
• C.The Automation Broker initiates an outbound SSL connection to Splunk Cloud, and the managed endpoint initiates an outbound connection to the Automation Broker.
• D.The Automation Broker initiates an inbound SSL connection to Splunk Cloud, and also initiates an outbound connection to the managed endpoints.

When should a detection be reviewed or retuned after deployment?

• A.Every 30 days.
• B.Only if it has generated a large amount of false positives.
• C.As defined by the established detection lifecycle.
• D.Only if it hasn't generated a finding after several weeks.

Which action improves the effectiveness of notable events in Enterprise Security?

• A.Applying suppression rules for false positives
• B.Disabling scheduled searches
• C.Limiting the search scope to one index
• D.Using only raw log data in searches