Online Access Free SPLK-5002 Practice Test

A SOC's Incident Response Standard Operating Procedure (SOP) calls for any phishing emails containing files to be detonated in Splunk Attack Analyzer for evaluation. Which of the following can an engineer implement to gain efficiency through automation?

• A.Automatically send all findings containing the tag "phishing" to create an email notification for the SOC.
• B.Automatically assign findings containing the tag "phishing" to analysts to speed up the start of data collection steps and reduce the time to disposition for the finding.
• C.Use a SOAR playbook to submit the email to PhishTank, which will automatically handle the Splunk Attack Analyzer submission, and make this information available to an assigned analyst.
• D.Use a SOAR playbook to handle the Splunk Attack Analyzer submission and data collection steps, and make this information available to an assigned analyst.

What is the primary purpose of data indexing in Splunk?

• A.To secure data from unauthorized access
• B.To visualize data using dashboards
• C.To store raw data and enable fast search capabilities
• D.To ensure data normalization

When building a metrics dashboard for the SOC manager, which metric would represent how long it takes to fully complete an investigation?

• A.MTTA
• B.MTTR
• C.MTTD
• D.MTBF

An engineer creates a new event type. What defines the association of this event type to an applicable data model?

• A.The tag(s)
• B.The field alias
• C.The search string
• D.The saved search name

An EDR tool was recently purchased and needs to be integrated into existing Splunk SOAR playbooks. Which actions are typically associated with this type of asset?

• A.Block device, remove email, detonate URL, get indicator
• B.Block hash, reset user password, quarantine device, get indicator
• C.Block hash, block process, quarantine device, get indicator
• D.Block URL, block subdomain, quarantine device, get indicator, detonate URL