Splunk SPLK-5001 - Questions & Answers

Which of the following is not a component of the Splunk Security Content library (ESCU, SSE)?

An organization is using Risk-Based Alerting (RBA). During the past few days, a user account generated multiple risk observations.
Splunk refers to this account as what type of entity?

A Cyber Threat Intelligence (CTI) team produces a report detailing a specific threat actor's typical behaviors and intent.
This would be an example of what type of intelligence?

Which field is automatically added to search results when assets are properly defined and enabled in Splunk Enterprise Security?

The following list contains examples of Tactics, Techniques, and Procedures (TTPs):

1. Exploiting a remote service

2. Lateral movement

3. Use EternalBlue to exploit a remote SMB server

In which order are they listed below?

What device typically sits at a network perimeter to detect command and control and other potentially suspicious traffic?

An analyst is not sure that all of the potential data sources at her company are being correctly or completely utilized by Splunk and Enterprise Security.

Which of the following might she suggest using, in order to perform an analysis of the data types available and some of their potential security uses?

A Cyber Threat Intelligence (CTI) team delivers a briefing to the CISO detailing their view of the threat landscape the organization faces.
This is an example of what type of Threat Intelligence?

An analyst is examining the logs for a web application's login form. They see thousands of failed logon attempts using various usernames and passwords. Internet research indicates that these credentials may have been compiled by combining account information from several recent data breaches.

Which type of attack would this be an example of?

Which of the following is considered Personal Data under GDPR?