Free Splunk SPLK-5003 Exam Dumps Questions & Answers

Which of the following is the first step in developing an effective integration strategy for diverse security data sources in a security operations center (SOC)?

• A.Define the security use cases and operational requirements that the data will support.
• B.Evaluate security information and event management (SIEM) systems.
• C.Hire a team of data engineers to manage the integrations.
• D.Begin collecting available logs from all systems.

Kevin is a SOC analyst working with the SRE team to investigate a report of slow responses from a customer-facing web application. While looking at load balancer and WAF logs, Kevin has discovered that one of the web servers hosting the application has gone offline. He does not see any alerts in the WAF or from the endpoint detection and response agent running on the web server. As part of triaging this incident, what should they do next? (Choose all that apply.)

• A.Review system logs collected from the server to identify who last logged into it.
• B.Provision a new server behind the load balancer to return the application to full service.
• C.Change the WAF from blocking mode to alert-only mode.
• D.Review recently scheduled requests in the company's change management system that may affect the same server.

A critical legacy application server runs on an unsupported OS and IT cannot install a security agent or forward logs on this server. This application processes sensitive data. What is the best strategy to continuously monitor the server's activities?

• A.Copy and review the access logs on a scheduled basis.
• B.Install MCP Security Monitoring.
• C.Disconnect the application from the network.
• D.Analyze network traffic via a tap.

AJ has been tasked with designing controls for a new low latency, highly resilient application. The business requires no downtime in the event of a device failure or during maintenance. Which of the following deployment options will meet these needs?

• A.Active/passive cluster
• B.Active/active cluster
• C.Diffused cluster
• D.Distributed cluster

A global enterprise is experiencing severe performance issues on their Splunk Enterprise Security Search Head due to an overwhelming number of distinct Asset and Identity lookups being performed simultaneously. What is the BEST architectural recommendation to resolve this performance issue?

• A.Ensure that Asset and Identity lookups are properly merged and consolidated, and configure the framework to use KV Store rather than standard CSVs for large datasets.
• B.Disable the Asset and Identity framework entirely.
• C.Enable Asset and Identity resolution at index time instead of search time.
• D.Increase the index-time extraction limits on the Heavy Forwarders.