Free certification test prep

NEW QUESTION 70
An analyst is building a search to examine Windows XML Event Logs, but the initial search is not returning any extracted fields. Based on the above image, what is the most likely cause?

NEW QUESTION 71
An analysis of an organization’s security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of implementing the new process or solution that was selected?

NEW QUESTION 72
A network security tool that continuously monitors a network for malicious activity and takes action to block it is known as which of the following?

NEW QUESTION 73
Which of the following is a correct Splunk search that will return results in the most performant way?

NEW QUESTION 74
While investigating findings in Enterprise Security, an analyst has identified a compromised device. Without leaving ES, what action could they take to run a sequence of containment activities on the compromised device that also updates the original finding?

NEW QUESTION 75
An analyst is building a search to examine Windows XML Event Logs, but the initial search is not returning any extracted fields. Based on the above image, what is the most likely cause?

NEW QUESTION 76
Which of the following use cases is best suited to be a Splunk SOAR Playbook?

NEW QUESTION 77
A threat hunter creates a model of normal, expected activity on a portion of their network. Later, they compare observed activity against this model, looking for significant deviations. What is another name for this model?

NEW QUESTION 78
What goal of an Advanced Persistent Threat (APT) group aims to disrupt or damage on behalf of a cause?

NEW QUESTION 79
A PCAP file contains what type of data?

NEW QUESTION 80
When threat hunting for outliers in Splunk, which of the following SPL pipelines would filter for users with over a thousand occurrences?

NEW QUESTION 81
Which of the following compliance frameworks was specifically created to measure the level of cybersecurity maturity within an organization?

NEW QUESTION 82
In Splunk Enterprise Security, annotations can be added to enrich correlation search results with security framework mappings. Which of the following security frameworks is not available as a default annotation option?

NEW QUESTION 83
During their shift, an analyst receives an alert about an executable being run from C:WindowsTemp. Why should this be investigated further?

NEW QUESTION 84
An analyst is investigating how an attacker successfully performs a brute-force attack to gain a foothold into an organizations systems. In the course of the investigation the analyst determines that the reason no alerts were generated is because the detection searches were configured to run against Windows data only and excluding any Linux data.
This is an example of what?

NEW QUESTION 85
A network security tool that continuously monitors a network for malicious activity and takes action to block it is known as which of the following?

NEW QUESTION 86
Which Splunk ES feature detects complex behavior over a “period of time” instead of “point in time” alerting?

NEW QUESTION 87
While the top command is utilized to find the most common values contained within a field, a Cyber Defense Analyst hunts for anomalies. Which of the following Splunk commands returns the least common values?

NEW QUESTION 88
A Cyber Threat Intelligence (CTI) team delivers a briefing to the CISO detailing their view of the threat landscape the organization faces. This is an example of what type of Threat Intelligence?

NEW QUESTION 89
Which Splunk app can help an organization inventory their data then find, deploy, and evaluate security detections to advance their security journey?

NEW QUESTION 90
What is the main difference between hypothesis-driven and data-driven Threat Hunting?