An attacker has been scanning a company's network for open ports and has identified a web server running an outdated version of Apache. The attacker then sends a crafted request that exploits a known vulnerability in that version, gaining a shell on the server. From there, the attacker uses the server to pivot and access internal databases. Which sequence of tactics and techniques best describes this attack?

Scanning, phishing, lateral movement

Reconnaissance, exploitation, lateral movement

Reconnaissance, social engineering, data exfiltration

Exploitation, privilege escalation, persistence

An attacker has been sending emails with malicious attachments to employees. One employee opens the attachment, which installs a keylogger. The attacker then uses the captured keystrokes to steal the employee's credentials and access the corporate network. Which attack type and technique best describe the full chain of events?

Web-based attack and data exfiltration

Social engineering and exploitation

A company's website is suddenly flooded with traffic from thousands of compromised IoT devices, causing the site to become unavailable to legitimate users. The attacker demands a ransom to stop the attack. Which attack vector and motivation best describe this incident?

DDoS with hacktivism motivation

Malware with espionage motivation

Ransomware with disruption motivation

DDoS with financial gain motivation

SplunkCertified Cybersecurity Defense Analyst

Domain 2Objective 1

Recognize Common Types of Attacks and Attack Vectors. SPLK-5001 Practice Questions (Page 4)

Part of the Threat and Attack Types, Motivations, and Tactics domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

20%of the exam

Questions 16–20

16foundation · easy
An attacker scans a company's public IP range to identify open ports and running services. Which tactic or technique does this activity represent?
Select an answer first
17application · medium
An attacker has been scanning a company's network for open ports and has identified a web server running an outdated version of Apache. The attacker then sends a crafted request that exploits a known vulnerability in that version, gaining a shell on the server. From there, the attacker uses the server to pivot and access internal databases. Which sequence of tactics and techniques best describes this attack?
Select an answer first
18expert · hard
An attacker has been sending emails with malicious attachments to employees. One employee opens the attachment, which installs a keylogger. The attacker then uses the captured keystrokes to steal the employee's credentials and access the corporate network. Which attack type and technique best describe the full chain of events?
Select an answer first
19foundation · easy
A group of attackers defaces a government website and leaks internal documents to protest a new policy. Which motivation best describes their actions?
Select an answer first
20application · medium
A company's website is suddenly flooded with traffic from thousands of compromised IoT devices, causing the site to become unavailable to legitimate users. The attacker demands a ransom to stop the attack. Which attack vector and motivation best describe this incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.

Recognize Common Types of Attacks and Attack Vectors. SPLK-5001 Practice Questions (Page 4)

Questions 16–20

An attacker scans a company's public IP range to identify open ports and running services. Which tactic or technique does this activity represent?

A group of attackers defaces a government website and leaks internal documents to protest a new policy. Which motivation best describes their actions?

A company's website is suddenly flooded with traffic from thousands of compromised IoT devices, causing the site to become unavailable to legitimate users. The attacker demands a ransom to stop the attack. Which attack vector and motivation best describe this incident?

Keep studying — Threat and Attack Types, Motivations, and Tactics