Free Splunk SPLK-5002 Exam Dumps Questions & Answers

Which tool can help identify known tactics, techniques, and procedures that a threat group is most likely to use when targeting a financial organization?

• A.  The MITRE ATT & CK matrix ' s industry heatmap in Splunk Security Essentials
• B.  Splunk Threat Intelligence Management
• C.  The Lockheed Martin Cyber Kill Chain Posture panel within Enterprise Security ' s Incident Review page
• D.  The MITRE ATT & CK Posture panel within Mission Control ' s Incident Review page

What is a key feature of effective security reports for stakeholders?

• A.  Excluding compliance-related metrics
• B.  Detailed event logs for every incident
• C.  Exclusively technical details for IT teams
• D.  High-level summaries with actionable insights

Which of the following should an engineer do as they evaluate their Threat Detection and Incident Response lifecycle?

• A.  Evaluate the threat process lifecycle solely from predefined technical profiles.
• B.  Focus efforts on the least impactful threat vectors.
• C.  Use the MITRE ATT & CK Framework to evaluate the organization ' s risk appetite.
• D.  Evaluate the threat process lifecycle based on contextual business and industry knowledge.

The SOC manager has a desire to measure mean time to acknowledge finding (notable event) in order to meet a desired service-level objective. Which two fields can be used to measure the difference?

• A.  Urgency, Status
• B.  Status, Owner
• C.  Severity, Owner
• D.  User, Status

Which Splunk feature makes SPL searches shorter and reusable by inserting it into search strings?

• A.  Commands
• B.  Knowledge objects
• C.  Lookups
• D.  Macros