6.8 Describe Managing, Orchestrating, and Automating Security Information and Events with Splunk 350-701 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC analyst is investigating a series of failed login attempts followed by a successful login from the same source IP address within a 10-minute window. The analyst needs to determine if this pattern indicates a successful brute-force attack. The authentication logs are indexed in Splunk with a sourcetype of 'linux:auth'. Which SPL query will identify the successful login that followed multiple failures from the same source IP?

   • A`sourcetype=linux:auth | stats count by src_ip, action | where action="success" AND count>5`
   • B`sourcetype=linux:auth action=success | join src_ip [search sourcetype=linux:auth action=failure]`
   • C`sourcetype=linux:auth | stats values(action) as actions by src_ip | where "success" in actions AND "failure" in actions`
   • D`sourcetype=linux:auth | transaction src_ip maxspan=10m | where mvcount(failures)>5 AND mvcount(successes)>0`
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In Splunk, which component is used to define a condition that triggers an alert when a search returns specific results?

   • ASaved search
   • BDashboard panel
   • CField extraction
   • DData input
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which Splunk capability is most directly used to support compliance reporting, such as demonstrating that firewall logs are retained for a required period?

   • AData retention policies
   • BAlert correlation
   • CUser role management
   • DDashboard visualization
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC is required to produce a monthly compliance report showing all authentication events for user accounts with administrative privileges. The report must include the username, source IP, timestamp, and success/failure status. The authentication logs are in Splunk with a sourcetype of 'windows:security'. Which SPL query will generate the required report data?

   • A`sourcetype=windows:security | fields - Account_Name, Source_Network_Address, action`
   • B`sourcetype=windows:security | table _time, Account_Name, Source_Network_Address, action`
   • C`sourcetype=windows:security | stats count by Account_Name, Source_Network_Address, action`
   • D`sourcetype=windows:security | eval report=_time + Account_Name + Source_Network_Address + action`
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of a correlation search in Splunk?

   • ATo manage user authentication and access control
   • BTo visualize data on a dashboard
   • CTo correlate data across multiple sources to detect patterns that indicate security threats
   • DTo compress and archive old data to reduce storage costs
   Reveal Solution Discussion Select an answer first