Incorporate Context into Detections (i.e. Correlation Search). CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which contextual data source would a correlation search use to determine if an IP address is associated with a known malicious actor?

   • AIdentity data
   • BThreat intelligence
   • CNetwork data
   • DAsset data
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A detection engineer wants to enrich a correlation search that flags suspicious login activity. Which type of contextual data would provide information about whether the target system is a critical production server or a low-value test host?

   • AAsset data
   • BNetwork data
   • CThreat intelligence
   • DIdentity data
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A correlation search flags when a user logs in from a new country. The team wants to reduce false positives by ignoring logins from countries where the user has a known office. The office locations are stored in a lookup keyed by username. Which search modification would achieve this?

   • AUse a subsearch to find all users with offices in the login country and exclude those users from the results.
   • BUse a join on the username field to combine login events with office locations, then keep only events where the countries differ.
   • CUse a lookup to add the user's office country to each login event, then filter out events where the login country matches the office country.
   • DUse the inputlookup command to load the office locations and then use the where command to compare countries.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A correlation search needs to add a field from a CSV file containing asset criticality, matching on the asset hostname. Which Splunk command is most appropriate for this enrichment?

   • Aeval
   • Bjoin
   • Csubsearch
   • Dlookup
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which type of contextual data would be most useful for identifying an anomaly where a user accesses a system outside their normal working hours?

   • ANetwork data
   • BIdentity data
   • CThreat intelligence
   • DAsset data
   Reveal Solution Discussion Select an answer first