SPLK-5001 Practice Exam Questions and Answers

A.  

NIST 800-53

B.  

ISO 27000

C.  

CIS18

D.  

MITRE ATT&CK

A.  

A DDoS attack is a type of physical attack, while a DoS attack is a type of cyberattack.

B.  

A DDoS attack uses a single source to target a single system, while a DoS attack uses multiple sources to target multiple systems.

C.  

A DDoS attack uses multiple sources to target a single system, while a DoS attack uses a single source to target a single or multiple systems.

D.  

A DDoS attack uses a single source to target multiple systems, while a DoS attack uses multiple sources to target a single system.

A.  

Streaming commands run before aggregating commands in the Search pipeline.

B.  

Raw word searches should contain multiple wildcards to ensure all edge cases are covered.

C.  

Limit fields returned from the search utilizing the cable command.

D.  

Searching over All Time ensures that all relevant data is returned.

A.  

The birth date of an unidentified user.

B.  

An individual's address including their first and last name.

C.  

The name of a deceased individual.

D.  

A company's registration number.

A.  

username

B.  

src_user_id

C.  

src_user

D.  

dest_user

A.  

IAM Activity

B.  

Malware Center

C.  

Access Anomalies

D.  

New Domain Analysis

A.  

Temp directories aren't owned by any particular user, making it difficult to track the process owner when files are executed.

B.  

Temp directories are flagged as non-executable, meaning that no files stored within can be executed, and this executable was run from that directory.

C.  

Temp directories contain the system page file and the virtual memory file, meaning the attacker can use their malware to read the in memory values of running programs.

D.  

Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions.

A.  

Tactical

B.  

Strategic

C.  

Operational

D.  

Executive

A.  

Utilize the transaction command to aggregate data for faster analysis.

B.  

Utilize Aggregating commands to ensure all data is available prior to Streaming commands.

C.  

Utilize specific fields to return only the data that is required.

D.  

Utilize multiple wildcards across fields to ensure returned data is complete and available.

A.  

sed

B.  

replace

C.  

mask

D.  

substitute