6.8 Describe Managing, Orchestrating, and Automating Security Information and Events with Splunk 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which Splunk use case involves searching for indicators of compromise (IOCs) across all ingested data?

   • AUser activity monitoring
   • BAsset inventory
   • CThreat hunting
   • DCompliance reporting
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC analyst is investigating a potential brute-force attack against a web application. The web server logs are being ingested into Splunk with a sourcetype of 'apache:access'. The analyst needs to extract the client IP address and the HTTP status code from each log line to correlate failed login attempts. The logs are in standard Apache combined log format. Which approach will allow the analyst to extract these fields for the investigation?

   • AModify the sourcetype definition in inputs.conf to automatically extract the fields, then wait for new data to arrive with the fields populated.
   • BUse the `lookup` command to map the client IP to a field named 'src_ip' and the status code to 'http_status'.
   • CConfigure a transforms.conf rule to extract the fields at index time, then rebuild the index to apply the new extraction to historical data.
   • DUse the `rex` command in the search to extract the client IP and status code using regular expressions at search time.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Splunk search command is used to extract and display only specific fields from the search results?

   • Atable
   • Bselect
   • Cwhere
   • Dfields
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of a dashboard in Splunk?

   • ATo provide a visual overview of multiple searches and metrics in one place
   • BTo store raw security events for long-term retention
   • CTo manage user roles and permissions
   • DTo configure alert actions for security events
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of integrating Splunk with an orchestration tool like Phantom or SOAR?

   • ATo provide a graphical interface for Splunk administration
   • BTo increase the storage capacity of the Splunk indexers
   • CTo replace the need for security analysts
   • DTo automate response actions based on detected security events
   Reveal Solution Discussion Select an answer first