6.8 Describe Managing, Orchestrating, and Automating Security Information and Events with Splunk 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In Splunk, what is the primary purpose of assigning roles to users?

   • ATo determine the storage quota for each user
   • BTo control access to data and capabilities based on job responsibilities
   • CTo increase the search speed for all users
   • DTo automatically generate reports for management
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC uses Splunk to detect phishing emails reported by users. When a phishing email is detected, the team wants to automatically block the sender's email address in the email security gateway and notify the incident response team. The email security gateway has a REST API for blocking senders. Which Splunk feature should be used to automate this response?

   • AConfigure a real-time alert with a webhook action that calls the email security gateway's REST API to block the sender.
   • BCreate a dashboard panel that displays the sender's address and rely on the SOC analyst to manually block it.
   • CUse the `outputlookup` command to save the sender's address to a CSV file for manual review.
   • DConfigure a scheduled search that runs every hour and sends an email to the email security team with the sender's address.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC manager wants to create a dashboard that shows the trend of security incidents over the past 30 days, broken down by incident type (e.g., malware, phishing, brute force). The dashboard should allow the manager to see the overall trend and the contribution of each incident type. Which Splunk visualization is best suited for this requirement?

   • AA stacked area chart with a search that uses `timechart count by incident_type`.
   • BA scatter chart with a search that uses `chart count by incident_type`.
   • CA pie chart with a search that uses `stats count by incident_type`.
   • DA single value panel with a search that uses `stats count`.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC manager wants to create a dashboard that shows the number of security events by severity level (critical, high, medium, low) for the last 24 hours, updated in near real-time. The dashboard will be displayed on a large monitor in the SOC for continuous monitoring. Which Splunk dashboard panel configuration best meets this requirement?

   • AA table panel with a search that runs on demand, listing all events with their severity levels.
   • BA bar chart panel with a real-time search using `sourcetype=security:events | timechart count by severity`.
   • CA single value panel with a search that runs every hour, showing the total count of critical events only.
   • DA pie chart panel with a search that runs every 5 minutes, using `sourcetype=security:events | stats count by severity`.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team wants to be notified immediately when more than 10 failed login attempts occur from a single source IP address within a 5-minute window. The team also wants to automatically create a ticket in their ITSM system when this condition is met. Which Splunk configuration should be used to meet both requirements?

   • ACreate a scheduled search that runs every 5 minutes and configure an alert action to send an email to the SOC team.
   • BCreate a scheduled search that runs every hour and configure a scripted alert action to log the events to a file.
   • CCreate a dashboard panel with a search that shows failed login attempts and manually review it periodically.
   • DCreate a real-time alert with a correlation search and configure a webhook alert action to trigger the ITSM ticket creation API.
   Reveal Solution Discussion Select an answer first