最新的Splunk Certified Cybersecurity Defense Engineer - SPLK-5002免費考試真題
Which of the following is the most efficient search to return a list of all visible indexes and the sourcetypes contained within them?
正確答案: D
說明：（僅 Fast2test 成員可見）
What is the best method to operationalize the results of a threat hunt for daily use by SOC analysts?
正確答案: C
說明：（僅 Fast2test 成員可見）
What framework in Enterprise Security allows engineers to build detections using known malicious IOCs, comparing them to event logs to find suspicious behavior?
正確答案: D
說明：（僅 Fast2test 成員可見）
The following SPL is designed to report on a certain SOC metric. Which metric is the most likely topic for this report?
| tstats summariesonly=true earliest(_time) as _time
FROM datamodel=Incident_Management
BY " Notable_Events.Meta.rule_id "
| rename " Notable_Events.Meta.* " as " * "
| lookup update=true incident_updates_lookup rule_id OUTPUTNEW time
| search time=*
| stats earliest(_time) as create_time, min(time) as triage_time by rule_id
| eval diff=triage_time-create_time,
stat_type=if(
create_time < relative_time(now(), " -7d@d " ),
" past " ,
" current "
),
past=if(stat_type= " past " , 1, 0),
current=if(stat_type= " current " , 1, 0),
past_diff=if(stat_type= " past " , diff, 0),
current_diff=if(stat_type= " current " , diff, 0)
| stats sum(past) AS past,
sum(current) AS current,
sum(past_diff) AS past_diff,
sum(current_diff) AS current_diff
| eval past=round(past_diff/past/60),
current=round(current_diff/current/60)
| table past, current
| transpose
| tstats summariesonly=true earliest(_time) as _time
FROM datamodel=Incident_Management
BY " Notable_Events.Meta.rule_id "
| rename " Notable_Events.Meta.* " as " * "
| lookup update=true incident_updates_lookup rule_id OUTPUTNEW time
| search time=*
| stats earliest(_time) as create_time, min(time) as triage_time by rule_id
| eval diff=triage_time-create_time,
stat_type=if(
create_time < relative_time(now(), " -7d@d " ),
" past " ,
" current "
),
past=if(stat_type= " past " , 1, 0),
current=if(stat_type= " current " , 1, 0),
past_diff=if(stat_type= " past " , diff, 0),
current_diff=if(stat_type= " current " , diff, 0)
| stats sum(past) AS past,
sum(current) AS current,
sum(past_diff) AS past_diff,
sum(current_diff) AS current_diff
| eval past=round(past_diff/past/60),
current=round(current_diff/current/60)
| table past, current
| transpose
正確答案: D
說明：（僅 Fast2test 成員可見）
Based on a recent red team exercise, an organization is highly concerned about pass the hash attacks especially including tools like Empire. Which EventCode associated to PowerShell Script Block Logging would be used to detect this activity?
正確答案: C
說明：（僅 Fast2test 成員可見）
A cyber defense engineer plays a role in maintaining a secure SOAR Cloud configuration. Which network security statement is correct about SOAR Cloud?
正確答案: B
說明：（僅 Fast2test 成員可見）
When creating a new playbook to be called directly from Mission Control or Enterprise Security, which type of playbook must be used?
正確答案: D
說明：（僅 Fast2test 成員可見）