A company has a mix of on-premises servers and cloud-based applications. They want a unified view of security events across both environments. Which approach is most effective?

Deploy an IDS in the cloud and a firewall on-premises

Deploy a SIEM that collects logs from both on-premises and cloud sources

Use separate monitoring tools for each environment

Use a threat intelligence platform for both environments

An analyst is investigating a potential malware infection on a server. They have captured network traffic and have access to the server's logs. Which combination of tools would provide the most comprehensive analysis?

Vulnerability scanner and threat intelligence platform

Log analyzer and threat intelligence platform

Packet analyzer and log analyzer

Packet analyzer and vulnerability scanner

SplunkCertified Cybersecurity Defense Analyst

Domain 3Objective 1

Identify Common Types of Cyber Defense Systems, Analysis Tools and the Most Useful Data Sources for Threat Analysis. SPLK-5001 Practice Questions (Page 5)

Part of the Defenses, Data Sources, and SIEM Best Practices domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

20%of the exam

Questions 21–25

21expert · hard
A company has a mix of on-premises servers and cloud-based applications. They want a unified view of security events across both environments. Which approach is most effective?
Select an answer first
22expert · hard
An analyst is investigating a potential malware infection on a server. They have captured network traffic and have access to the server's logs. Which combination of tools would provide the most comprehensive analysis?
Select an answer first
23application · medium
An analyst is investigating a data exfiltration incident. Which data source would provide the most useful evidence of the data leaving the network?
Select an answer first
24foundation · easy
Which data source is most appropriate to feed into an EDR system to detect malicious processes and file modifications on workstations?
Select an answer first
25foundation · easy
To detect and block malicious traffic at the network perimeter, which data source is most directly used by an IPS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.

Identify Common Types of Cyber Defense Systems, Analysis Tools and the Most Useful Data Sources for Threat Analysis. SPLK-5001 Practice Questions (Page 5)

Questions 21–25

A company has a mix of on-premises servers and cloud-based applications. They want a unified view of security events across both environments. Which approach is most effective?

An analyst is investigating a potential malware infection on a server. They have captured network traffic and have access to the server's logs. Which combination of tools would provide the most comprehensive analysis?

An analyst is investigating a data exfiltration incident. Which data source would provide the most useful evidence of the data leaving the network?

Which data source is most appropriate to feed into an EDR system to detect malicious processes and file modifications on workstations?

To detect and block malicious traffic at the network perimeter, which data source is most directly used by an IPS?

Keep studying — Defenses, Data Sources, and SIEM Best Practices