Describe How Splunk Security Essentials and Splunk Enterprise Security Can Be Used to Assess Data Sources, Including Common Sourcetypes for On-Prem and Cloud Based Deployments and How to Find Content for a Given Sourcetype. SPLK-5001 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team has Splunk Security Essentials installed and is ingesting AWS CloudTrail, AWS VPC Flow Logs, and AWS GuardDuty findings. The team runs the Data Source Assessment and sees that the 'Cloud Infrastructure' coverage is only 40%. The team wants to improve coverage without adding new data sources. Which action would most directly improve the coverage score?

   • AEnable additional AWS sourcetypes that are already being collected but are not mapped in the assessment.
   • BIncrease the index volume for the existing AWS sourcetypes.
   • CCreate custom correlation searches for the existing AWS sourcetypes.
   • DInstall the Splunk Add-on for AWS and restart the forwarder.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In Splunk Enterprise Security, which page would you use to see the status of all data sources and identify any that are not sending data?

   • AAssets
   • BIncident Review
   • CDashboards
   • DData Sources
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which sourcetype is commonly associated with Windows operating system security logs?

   • Alinux_secure
   • Bapache_access
   • Csyslog
   • DWinEventLog:Security
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of Splunk Security Essentials in a security operations environment?

   • ATo help security teams assess their data sources, identify gaps in coverage, and implement security content such as correlation searches and dashboards
   • BTo replace the need for a SIEM by providing real-time threat intelligence feeds and automated threat hunting
   • CTo provide a centralized platform for managing security incidents and orchestrating response actions
   • DTo provide a compliance reporting tool that automatically generates audit reports for regulatory frameworks
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A Splunk Enterprise Security administrator is reviewing the environment and notices that the 'Cloud Infrastructure' data source category shows a low 'data source health' score. The organization uses AWS CloudTrail, AWS Config, and Amazon GuardDuty as its primary cloud security sources. The administrator wants to identify which specific sourcetypes are missing or not populating correctly. Which Splunk Enterprise Security interface should the administrator use first?

   • AThe Data Sources page in Splunk Enterprise Security, filtering by the Cloud Infrastructure category.
   • BThe Security Posture dashboard in Splunk Enterprise Security.
   • CThe Audit dashboard in Splunk Enterprise Security.
   • DThe Splunk Security Essentials Data Source Assessment.
   Reveal Solution Discussion Select an answer first