A security analyst is investigating a potential data exfiltration. The analyst notices that a user is uploading large files to a cloud storage service that is not commonly used in the organization. What should the analyst do next?

Ignore the activity because cloud storage is common.

Block access to the cloud storage service immediately.

Contact the user to ask why they are uploading files.

Check the user's historical usage of the cloud storage service.

An organization wants to detect insider threats by identifying employees who access sensitive data outside of their normal working hours. Which anomaly detection model would be most appropriate?

A model that flags any access to sensitive data that is not approved by a manager.

A model that learns each employee's typical working hours and flags deviations.

A model that flags any access to sensitive data from a remote location.

A model that flags any access to sensitive data after 6 PM.

A threat hunter is investigating a potential advanced persistent threat (APT) that uses legitimate tools and services. The hunter has a list of known IOCs, but the APT is using new infrastructure. Which hunting technique would be most effective in this scenario?

Use behavioral analytics to identify unusual patterns of activity that may indicate the APT's presence.

Disable all external communication to prevent the APT from operating.

Focus on hunting for the known IOCs across all data sources.

Rely on threat intelligence feeds to identify the new infrastructure.

SplunkCertified Cybersecurity Defense Analyst

Domain 6Objective 1

Identify Threat Hunting Techniques Including Configuration, Modeling (anomalies), Indicators, and Behavioral Analytics. SPLK-5001 Practice Questions (Page 5)

Part of the Threat Hunting and Remediation domain, which accounts for 10% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

10%of the exam

Questions 21–24

21application · medium
A security analyst is investigating a potential data exfiltration. The analyst notices that a user is uploading large files to a cloud storage service that is not commonly used in the organization. What should the analyst do next?
Select an answer first
22application · medium
An organization wants to detect insider threats by identifying employees who access sensitive data outside of their normal working hours. Which anomaly detection model would be most appropriate?
Select an answer first
23foundation · easy
Which Splunk feature is specifically used to model normal behavior and detect anomalies in security data?
Select an answer first
24expert · hard
A threat hunter is investigating a potential advanced persistent threat (APT) that uses legitimate tools and services. The hunter has a list of known IOCs, but the APT is using new infrastructure. Which hunting technique would be most effective in this scenario?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.

Identify Threat Hunting Techniques Including Configuration, Modeling (anomalies), Indicators, and Behavioral Analytics. SPLK-5001 Practice Questions (Page 5)

Questions 21–24

A security analyst is investigating a potential data exfiltration. The analyst notices that a user is uploading large files to a cloud storage service that is not commonly used in the organization. What should the analyst do next?

An organization wants to detect insider threats by identifying employees who access sensitive data outside of their normal working hours. Which anomaly detection model would be most appropriate?

Which Splunk feature is specifically used to model normal behavior and detect anomalies in security data?

A threat hunter is investigating a potential advanced persistent threat (APT) that uses legitimate tools and services. The hunter has a list of known IOCs, but the APT is using new infrastructure. Which hunting technique would be most effective in this scenario?

Keep studying — Threat Hunting and Remediation