During an incident response, an analyst discovers that the attacker used a technique that is not well-documented in the organization's threat intelligence. The analyst wants to improve the organization's ability to detect this technique in the future. Which action is most appropriate?

Create a detection rule based on the specific tool and command-line arguments used in this incident.

Wait for the threat intelligence vendor to provide an update before creating any detection rules.

Block all traffic to the IP addresses observed in the incident.

Research the technique and develop a detection rule that identifies the general behavior.

Which of the following best describes a 'procedure' in the context of TTPs?

The specific, detailed steps an adversary follows when executing a technique.

The overarching goal an adversary aims to accomplish.

The general method or approach used to achieve a goal.

The category of tools an adversary prefers to use.

A security operations center (SOC) is overwhelmed by alerts from a new detection rule that monitors for a specific technique. The rule generates many false positives because the technique is also used by legitimate administrative tools. The SOC manager wants to reduce false positives while maintaining detection of the technique. Which approach is most effective?

Add a filter to exclude alerts from known legitimate administrative tools.

Increase the alert severity to prioritize the alerts.

Disable the detection rule entirely to eliminate false positives.

Change the rule to match the exact command-line arguments used in the original attack.

How does the industry's view of TTPs support defensive strategies?

By eliminating the need for incident response planning.

By guaranteeing that all attacks will be prevented.

By focusing only on the attacker's motivation and not on their actions.

By providing a way to map adversary behavior to specific detection and mitigation opportunities.

A threat intelligence analyst is investigating a series of intrusions that share similar TTPs but use different malware families. The analyst wants to determine if these intrusions are likely the work of the same adversary group. Which approach is most appropriate?

Ignore the TTPs and focus only on the malware hashes to determine attribution.

Compare the TTPs with known adversary profiles and consider additional context such as targeting and infrastructure.

Conclude that they are the same group because the TTPs are similar.

Conclude that they are different groups because the malware families are different.

SplunkCertified Cybersecurity Defense Analyst

Domain 2Objective 5

Define Tactics, Techniques and Procedures and How They Are Regarded in the Industry. SPLK-5001 Practice Questions (Page 2)

Part of the Threat and Attack Types, Motivations, and Tactics domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

4concepts

20%of the exam

Questions 6–10

6expert · hard
During an incident response, an analyst discovers that the attacker used a technique that is not well-documented in the organization's threat intelligence. The analyst wants to improve the organization's ability to detect this technique in the future. Which action is most appropriate?
Select an answer first
7foundation · easy
Which of the following best describes a 'procedure' in the context of TTPs?
Select an answer first
8expert · hard
A security operations center (SOC) is overwhelmed by alerts from a new detection rule that monitors for a specific technique. The rule generates many false positives because the technique is also used by legitimate administrative tools. The SOC manager wants to reduce false positives while maintaining detection of the technique. Which approach is most effective?
Select an answer first
9foundation · easy
How does the industry's view of TTPs support defensive strategies?
Select an answer first
10expert · hard
A threat intelligence analyst is investigating a series of intrusions that share similar TTPs but use different malware families. The analyst wants to determine if these intrusions are likely the work of the same adversary group. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.