Describe How Splunk Security Essentials and Splunk Enterprise Security Can Be Used to Assess Data Sources, Including Common Sourcetypes for On-Prem and Cloud Based Deployments and How to Find Content for a Given Sourcetype. SPLK-5001 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard · select all that apply

   A security team is ingesting data from multiple cloud sources into Splunk Enterprise Security. The team wants to use the Data Sources page to assess the health of their cloud data sources and then find relevant content in Splunk Security Essentials. The team is currently ingesting AWS CloudTrail, Azure Activity Log, and Google Workspace. Select all the sourcetypes that the team should expect to see in the Data Sources page for these cloud sources.

   • Aaws:cloudtrail
   • Bgoogle:workspace
   • Cazure:activity
   • Daws:guardduty
   • Eazure:signin
   Check answers Discussion Select an answer first
2. 12foundation · easy

   In Splunk Security Essentials, what does the 'Data Source Coverage' view help you do?

   • AIt provides a list of all available Splunk apps and add-ons
   • BIt displays the raw logs from all data sources in real time
   • CIt automatically configures data inputs for all detected devices
   • DIt shows which data sources are currently being ingested and which are missing or have gaps
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company runs a traditional on-premises data center with Windows servers, Cisco ASA firewalls, and a custom Java application. The security team is using Splunk Security Essentials to assess their data source coverage. Which set of sourcetypes would the assessment most likely identify as expected for these three on-premises components?

   • AWinEventLog:System, cisco:ios, and python:app
   • Blinux_secure, pan:firewall, and apache:access
   • CWinEventLog:Security, cisco:asa, and java:app
   • DWinRegistry, netscaler, and node:app
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which sourcetype is commonly used for AWS CloudTrail logs?

   • Acloud:trail
   • Baws:cloudtrail
   • Cazure:activity
   • Dgcp:audit
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is setting up monitoring for a new Microsoft 365 deployment. The analyst has configured the Office 365 add-on and confirmed that data is flowing into Splunk. The analyst wants to find existing Splunk Security Essentials content (such as correlation searches and dashboards) that is specifically designed for the Office 365 sourcetype. Which approach should the analyst use?

   • ASearch the Splunk Enterprise Security Data Sources page for 'o365'.
   • BRun a search for 'index=main sourcetype=o365' and manually build a dashboard.
   • CReview the Splunk Add-on for Office 365 documentation to find built-in correlation searches.
   • DUse the Splunk Security Essentials content library and filter by the 'o365' sourcetype.
   Reveal Solution Discussion Select an answer first