SPLK-5002 무료 덤프문제 온라인 액세스

While working with the SOC analysts to review current contextualization processes, a request for automation has been raised by the SOC team. They are asking for a new automation that will check a potentially malicious URL against a remote URL filtering list. Which of the following options will work for them?

• A.Adaptive Response Action or Input Playbook
• B.Input Playbook
• C.Neither Adaptive Action or Input Playbook
• D.Adaptive Response Action

When developing security metrics, why would a Key Performance Indicator (KPI) that focuses on total perimeter firewall blocks be an ineffective metric?

• A.Perimeter firewalls are exposed on the internet directly and thus subject to automated scanners and attack tools.
• B.Perimeter firewalls should be measured on both the number of connections that they permit as well as the number they block.
• C.The metric is too high level, it should be broken down by the type of block. For example, blocks of remote systems that have repeated failed connections to services that do not exist.
• D.This a Key Result Indicator, not a KPI. It is a metric that is measuring the results of the perimeter firewall ' s actions, not the performance of the firewall.

Which of the following cURL commands would allow an engineer to effectively disable the REST API endpoint they ' ve been utilizing for testing a detection named TestSearchDevelopment?

• A.Splunk endpoints cannot be disabled.
• B.curl -k -u admin\:pass https://localhost:8089/servicesNS/admin/search/saved/searches
  /TestSearchDevelopment/disable -X POST
• C.curl -k -u admin\:pass https://localhost:8089/servicesNS/admin/search/saved/searches
  /TestSearchDevelopment/ -X DELETE
• D.curl -k -u admin\:pass https://localhost:8089/servicesNS/admin/search/saved/searches
  /TestSearchDevelopment/disable -X PUT

A SOC ' s Incident Response Standard Operating Procedure (SOP) calls for any phishing emails containing files to be detonated in Splunk Attack Analyzer for evaluation. Which of the following can an engineer implement to gain efficiency through automation?

• A.Use a SOAR playbook to submit the email to PhishTank and have it perform the Splunk Attack Analyzer submission.
• B.Automatically send an email notification for all findings containing the phishing tag.
• C.Automatically assign phishing-tagged findings to analysts to begin manual collection.
• D.Use a SOAR playbook to handle the Splunk Attack Analyzer submission and data-collection steps and make the information available to an assigned analyst.

In Enterprise Security, what is the name of the threat intelligence lookup pertaining to files?

• A.user_intel
• B.user_hash
• C.file_hash
• D.file_intel