6.8 Describe Managing, Orchestrating, and Automating Security Information and Events with Splunk 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC analyst is investigating a security incident involving a compromised user account. The analyst needs to search for all events related to the user 'jsmith' across multiple data sources, including authentication logs, firewall logs, and endpoint logs. The data sources use different field names for the username (e.g., 'user', 'src_user', 'Account_Name'). Which Splunk approach will allow the analyst to search across all data sources using a single field name?

   • ACreate a field alias in props.conf that maps the different field names to a common field name, then search using the common name.
   • BUse the `rename` command in the search to rename each field to a common name, then search for the user.
   • CSearch for the username in the raw event text using `jsmith` as a keyword, without relying on field names.
   • DUse the `eval` command to create a new field with the username, then search for the user in the new field.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a Splunk deployment, which component is responsible for collecting data from remote sources and forwarding it to the indexing tier?

   • AForwarder
   • BDeployment server
   • CIndexer
   • DSearch head
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a Splunk search, which command would you use to return only the first 10 results?

   • Atop
   • Blimit
   • Ctail
   • Dhead
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations center (SOC) is deploying Splunk Enterprise to centralize logs from 500 remote firewalls and 200 endpoint agents. The team needs to minimize bandwidth usage on the WAN links while still enabling rapid search across all data. The Splunk architect has decided to use a two-tier deployment with forwarders sending data to a single indexer cluster. Which component placement best meets the bandwidth and search performance requirements?

   • AInstall universal forwarders at each remote site to send raw data directly to the indexer cluster, relying on the indexers to parse and filter all events centrally.
   • BInstall an indexer at each remote site and configure them to forward only summary data to the central search head for correlation.
   • CInstall a search head at each remote site to query the central indexer cluster directly, eliminating the need for forwarders entirely.
   • DInstall a heavy forwarder at each remote site to perform parsing and filtering before sending only relevant events to the central indexer cluster.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In Splunk, which visualization type is best suited for displaying the trend of security events over time?

   • ALine chart
   • BPie chart
   • CScatter plot
   • DSingle value
   Reveal Solution Discussion Select an answer first