A company wants to detect malicious activity on employee laptops that may occur even when the devices are off the corporate network. Which defense system is most suitable?

Endpoint detection and response (EDR)

Network-based intrusion prevention system (NIPS)

Security information and event management (SIEM)

A SOC wants to correlate authentication failures across multiple systems and automate a response to block the offending source IP. Which data sources and systems should be integrated?

Firewall logs feeding an IDS, with manual response procedures

Authentication logs from all systems feeding a SIEM, with a SOAR platform to automate the block

Endpoint logs feeding an EDR, with a packet analyzer for response

Threat intelligence feeds feeding a firewall, with a log analyzer for correlation

A security team is deploying a new monitoring solution. They need to detect both known signature-based attacks and anomalous behavior that may indicate zero-day threats. They also want to minimize false positives. Which approach is most effective?

Deploy a firewall with application control

Deploy an IDS with signature-based detection and a separate system for anomaly detection

A security team needs to detect and block malicious traffic at the network perimeter while also capturing detailed logs of allowed traffic for later analysis. Which combination of systems should they deploy?

Web application firewall (WAF) and database activity monitoring (DAM)

Endpoint detection and response (EDR) and host-based intrusion prevention system (HIPS)

Security information and event management (SIEM) and security orchestration, automation, and response (SOAR)

Firewall and network-based intrusion detection system (NIDS)

SplunkCertified Cybersecurity Defense Analyst

Domain 3Objective 1

Identify Common Types of Cyber Defense Systems, Analysis Tools and the Most Useful Data Sources for Threat Analysis. SPLK-5001 Practice Questions (Page 2)

Part of the Defenses, Data Sources, and SIEM Best Practices domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

20%of the exam

Questions 6–10

6application · medium
An analyst needs to search through millions of log entries to find a specific event that occurred at a particular time. Which tool is most efficient for this task?
Select an answer first
7application · medium
A company wants to detect malicious activity on employee laptops that may occur even when the devices are off the corporate network. Which defense system is most suitable?
Select an answer first
8application · medium
A SOC wants to correlate authentication failures across multiple systems and automate a response to block the offending source IP. Which data sources and systems should be integrated?
Select an answer first
9expert · hard
A security team is deploying a new monitoring solution. They need to detect both known signature-based attacks and anomalous behavior that may indicate zero-day threats. They also want to minimize false positives. Which approach is most effective?
Select an answer first
10application · medium
A security team needs to detect and block malicious traffic at the network perimeter while also capturing detailed logs of allowed traffic for later analysis. Which combination of systems should they deploy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.