Recognize Common Cyber Industry Controls, Standards and Frameworks and How Splunk Incorporates Those Frameworks. SPLK-5001 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A multinational company must comply with both ISO 27001 and NIST CSF. They use Splunk for security monitoring. They need to produce evidence for an ISO 27001 audit while also improving their NIST CSF maturity. Which approach best satisfies both requirements?

   • AUse separate tools for ISO 27001 and NIST CSF to avoid confusion
   • BFocus only on ISO 27001 compliance and ignore NIST CSF
   • CUse Splunk to collect and retain logs that support ISO 27001 audit evidence, and map those logs to NIST CSF functions
   • DPrioritize NIST CSF and use manual evidence collection for ISO 27001
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is designing a defense-in-depth strategy. They have implemented preventive controls like firewalls and antivirus. They want to add a control that provides early warning of an attack in progress. They plan to use Splunk for this. Which type of control should they add?

   • APreventive control using additional firewalls
   • BCorrective control using automated incident response
   • CDetective control using Splunk correlation searches
   • DDeterrent control using warning banners
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security team deploys a system that automatically blocks traffic from an IP address after detecting repeated failed login attempts. Which type of security control does this system primarily represent?

   • APreventive control
   • BCorrective control
   • CDeterrent control
   • DDetective control
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which framework is organized around five core functions: Identify, Protect, Detect, Respond, and Recover?

   • ANIST Cybersecurity Framework (CSF)
   • BCIS Controls
   • CMITRE ATT&CK
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOC is using Splunk Enterprise Security (ES) and wants to align with both NIST CSF and MITRE ATT&CK. They have limited resources and must prioritize which detections to develop. They notice that their current detections cover many ATT&CK techniques but they are unsure which ones to focus on. Which approach best balances framework alignment with resource constraints?

   • AFocus only on NIST CSF functions and ignore ATT&CK mapping
   • BDevelop detections for all ATT&CK techniques to achieve complete coverage
   • CUse only out-of-the-box detections from Splunk ES without customization
   • DPrioritize detections for techniques that map to high-impact NIST CSF functions and are relevant to their environment
   Reveal Solution Discussion Select an answer first