Define Long Tail Analysis, Outlier Detection, and Some Common Steps of Hypothesis Hunting with Splunk. SPLK-5001 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is outlier detection in the context of cybersecurity data analysis?

   • AThe process of grouping similar data points together based on their characteristics
   • BThe process of predicting future data points based on historical trends
   • CThe process of removing all data points that are not part of a known attack signature
   • DThe process of identifying data points that deviate significantly from expected patterns
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is reviewing proxy logs to find signs of command-and-control (C2) communication. They know that most users visit a small set of popular domains, but they want to focus on the many domains that are each visited very infrequently, because C2 domains often fall into that category. Which analytical approach is the team applying?

   • ABaseline profiling
   • BLong tail analysis
   • COutlier detection
   • DClustering analysis
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Splunk analyst has formed the hypothesis that 'lateral movement is occurring via SMB from workstations to servers outside normal business hours.' The analyst has collected and analyzed the relevant SMB traffic and found several connections that match the hypothesis. What is the next step in the hypothesis hunting process?

   • AExpand the search to include all network traffic for the last year
   • BDocument the hypothesis as confirmed and close the hunt
   • CImmediately isolate the involved workstations from the network
   • DValidate the findings by correlating with other data sources, such as authentication logs and endpoint detection alerts
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A threat hunter has completed a hypothesis hunt and found a set of endpoints that appear to be beaconing to a known malicious domain. The hunter wants to ensure the findings are solid before escalating to incident response. Which action is most aligned with the validation step of hypothesis hunting?

   • ADocument the findings and move on to the next hypothesis
   • BRe-run the same search multiple times to see if the results are consistent
   • CImmediately isolate the endpoints from the network to prevent further compromise
   • DCorrelate the beaconing activity with other data sources, such as process creation logs and network connections, to confirm the behavior is not a false positive
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Splunk analyst wants to detect anomalous outbound connections from a web server. The analyst has a baseline of the number of outbound connections per hour over the past 60 days. Which Splunk search would be most effective for identifying an outlier hour?

   • AUse `timechart` to count connections per hour, then apply the `outlier` command to the count field
   • BUse `rare` to list the hours with the fewest connections
   • CUse `top` to list the hours with the most connections
   • DUse `stats` to compute the average connections per hour and filter for hours above the average
   Reveal Solution Discussion Select an answer first