A security analyst needs to inspect the raw contents of a suspicious network conversation, including the payload data, to determine if an exploit was attempted. Which tool is most appropriate?

Packet analyzer (e.g., Wireshark)

A company wants to automatically respond to common threats, such as phishing emails, by quarantining them and notifying the security team. Which system is designed for this type of automated response?

Endpoint detection and response (EDR)

Security orchestration, automation, and response (SOAR)

Intrusion detection system (IDS)

A security team needs to detect lateral movement within the internal network. Which combination of data sources would be most effective?

Threat intelligence feeds and vulnerability scan reports

Authentication logs and network connection logs

Email logs and file integrity monitoring logs

An analyst is investigating a suspected brute-force attack on a corporate VPN. Which data source would provide the most direct evidence of the attack?

Endpoint logs from a single workstation

Authentication logs from the VPN gateway

Network flow logs from the core switch

SplunkCertified Cybersecurity Defense Analyst

Domain 3Objective 1

Identify Common Types of Cyber Defense Systems, Analysis Tools and the Most Useful Data Sources for Threat Analysis. SPLK-5001 Practice Questions (Page 1)

Part of the Defenses, Data Sources, and SIEM Best Practices domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

20%of the exam

Questions 1–5

1application · medium
A security team wants to detect command-and-control (C2) traffic from malware. Which data source is most likely to reveal this activity?
Select an answer first
2application · medium
A security analyst needs to inspect the raw contents of a suspicious network conversation, including the payload data, to determine if an exploit was attempted. Which tool is most appropriate?
Select an answer first
3application · medium
A company wants to automatically respond to common threats, such as phishing emails, by quarantining them and notifying the security team. Which system is designed for this type of automated response?
Select an answer first
4application · medium
A security team needs to detect lateral movement within the internal network. Which combination of data sources would be most effective?
Select an answer first
5application · medium
An analyst is investigating a suspected brute-force attack on a corporate VPN. Which data source would provide the most direct evidence of the attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.