Adversaries commonly execute discovery commands such as netexe, ipconfig.exe, and whoami exe. Rather than query for each of these commands individually, you would like to use a single query with all of them. What Splunk operator is needed to complete the following query?

• A. OR
• B. AND
• C. IN
• D. NOT

Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

• A. Sensor reports
• B. Hunt reports
• C. Timeline reports
• D. Scheduled searches

The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:

• A. A publicly available web application has been hacked and is causing the lockouts
• B. Users are locking their accounts out because they recently changed their passwords
• C. A password guessing attack is being executed against remote access mechanisms such as VPN
• D. A zero-day vulnerability is being exploited on a Microsoft Exchange server

The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?

• A. ParentProcessld_decimal
• B. ContextProcessld_decimal
• C. RpcProcessld_decimal
• D. RawProcessld_decimal