An analyst needs to enrich an alert with external context about a suspicious IP address, such as known malicious activity and associated campaigns. Which type of tool provides this information?

Endpoint detection and response (EDR) tool

A security team wants to detect insider threats, such as employees accessing sensitive data outside of normal working hours. Which data sources and systems should they combine?

Threat intelligence feeds and a SOAR platform

Vulnerability scan reports and a packet analyzer

Authentication logs, data access logs, and a SIEM for correlation

SplunkCertified Cybersecurity Defense Analyst

Domain 3Objective 1

Identify Common Types of Cyber Defense Systems, Analysis Tools and the Most Useful Data Sources for Threat Analysis. SPLK-5001 Practice Questions (Page 3)

Part of the Defenses, Data Sources, and SIEM Best Practices domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

20%of the exam

Questions 11–15

11foundation · easy
An analyst needs to enrich an alert with external context about a suspicious IP address, such as known malicious activity and associated campaigns. Which type of tool provides this information?
Select an answer first
12foundation · easy
Which analysis tool is most appropriate for inspecting the contents of individual network packets to troubleshoot a suspected malware communication?
Select an answer first
13foundation · easy
An organization wants a system that can automatically respond to low-level security incidents by executing predefined playbooks, reducing manual intervention. Which type of cyber defense system is designed for this purpose?
Select an answer first
14application · medium
A security team needs to identify which vulnerabilities exist on their servers before an attacker exploits them. Which tool should they use?
Select an answer first
15expert · hard
A security team wants to detect insider threats, such as employees accessing sensitive data outside of normal working hours. Which data sources and systems should they combine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.

Identify Common Types of Cyber Defense Systems, Analysis Tools and the Most Useful Data Sources for Threat Analysis. SPLK-5001 Practice Questions (Page 3)

Questions 11–15

An analyst needs to enrich an alert with external context about a suspicious IP address, such as known malicious activity and associated campaigns. Which type of tool provides this information?

Which analysis tool is most appropriate for inspecting the contents of individual network packets to troubleshoot a suspected malware communication?

An organization wants a system that can automatically respond to low-level security incidents by executing predefined playbooks, reducing manual intervention. Which type of cyber defense system is designed for this purpose?

A security team needs to identify which vulnerabilities exist on their servers before an attacker exploits them. Which tool should they use?

A security team wants to detect insider threats, such as employees accessing sensitive data outside of normal working hours. Which data sources and systems should they combine?

Keep studying — Defenses, Data Sources, and SIEM Best Practices