Describe How Splunk Security Essentials and Splunk Enterprise Security Can Be Used to Assess Data Sources, Including Common Sourcetypes for On-Prem and Cloud Based Deployments and How to Find Content for a Given Sourcetype. SPLK-5001 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A Splunk Enterprise Security administrator is responsible for a hybrid environment with on-premises Windows servers, Linux servers, and Cisco ASA firewalls, plus AWS CloudTrail and GuardDuty. The administrator notices that the 'Endpoint' data source category shows a low health score, while the 'Network' and 'Cloud' categories appear healthy. The administrator suspects that some Windows event logs are not being collected. The administrator wants to confirm which specific Windows sourcetypes are missing and then determine which Splunk Security Essentials content would be affected. Which sequence of actions should the administrator take?

   • ACheck the Data Sources page in Enterprise Security for the Endpoint category, then filter the Splunk Security Essentials content library by the missing sourcetypes.
   • BRun the Splunk Security Essentials Data Source Assessment, then review the Enterprise Security Correlation Searches page.
   • CCheck the Security Posture dashboard, then run a search for 'index=main sourcetype=WinEventLog:*'.
   • DReview the Splunk Add-on for Windows inputs, then check the AWS CloudTrail sourcetype in the Data Sources page.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is investigating a potential brute-force attack on a Windows server. The analyst knows that Windows security logs are being ingested with the sourcetype 'WinEventLog:Security'. The analyst wants to find existing correlation searches in Splunk Security Essentials that are specifically designed for this sourcetype to detect brute-force attempts. Which method should the analyst use?

   • AOpen the Splunk Security Essentials content library and filter by 'WinEventLog:Security'.
   • BRun a search for 'sourcetype=WinEventLog:Security' and manually review the events.
   • CReview the Splunk Add-on for Windows inputs configuration.
   • DCheck the Splunk Enterprise Security Data Sources page for WinEventLog:Security.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A small security team is new to Splunk and has just started ingesting Windows event logs and Linux syslog from their on-premises servers. They want to understand which security use cases they can currently detect with the data they have, and which use cases require additional data sources. The team does not yet have Splunk Enterprise Security installed. Which tool should they use to perform this gap analysis?

   • ASplunk Enterprise Security
   • BSplunk Security Essentials
   • CThe Splunk Add-on for Windows
   • DThe Splunk Audit Logs dashboard
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which sourcetype is commonly used for network device logs from firewalls and routers?

   • Acisco:asa
   • BWinRegistry
   • Ciis
   • Dauditd
   Reveal Solution Discussion Select an answer first
6. 10expert · hard · select all that apply

   A security team is evaluating whether to use Splunk Security Essentials to assess their on-premises data sources. The team currently ingests Windows security logs, Linux syslog, and Cisco ASA firewall logs. They want to use Splunk Security Essentials to identify gaps in their security coverage. Select all the actions that Splunk Security Essentials can perform to help the team achieve this goal.

   • ARun a Data Source Assessment that maps ingested sourcetypes to security content and identifies missing coverage.
   • BProvide a content library of correlation searches and dashboards that can be filtered by sourcetype.
   • CReplace the need for Splunk Enterprise Security in a security operations environment.
   • DGenerate a report showing which security use cases are covered and which require additional data sources.
   • EAutomatically configure the Splunk Add-on for Windows to collect additional event logs.
   Check answers Discussion Select an answer first