Incorporate Context into Detections (i.e. Correlation Search). CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–13

1. 11foundation · easy

   Which Splunk technique would you use to enrich events with the result of a separate, dynamically-generated search that returns a small set of values?

   • ATransaction
   • BLookup
   • CSubsearch
   • DRex
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of incorporating context into alerting and response workflows?

   • ATo replace the need for threat intelligence
   • BTo automatically remediate all incidents without human review
   • CTo prioritize incidents based on the affected asset's criticality
   • DTo increase the number of alerts generated
   Reveal Solution Discussion Select an answer first
3. 13application · medium

   A correlation search detects a potential credential-stuffing attack. The security team wants the alert to include the affected user's role and department so responders can prioritize. The user information is stored in a CSV lookup. What is the most efficient way to include this context in the alert?

   • AUse a subsearch to retrieve user details and then use the append command to add them to the alert.
   • BAdd a lookup command to the correlation search to enrich the events with user details, then include those fields in the alert message.
   • CHave responders manually look up the user in the CSV when they receive the alert.
   • DCreate a separate correlation search that runs after the first to look up user details and send a second alert.
   Reveal Solution Discussion Select an answer first