Splunk Certified Cybersecurity Defense Analyst Practice Test
Gana confianza para Splunk Certified Cybersecurity Defense Analyst. Practica los conceptos, comprende las respuestas y refuerza tus conocimientos pregunta a pregunta.
Probar una preguntaExamen de certificación
66
Preguntas del examen
1 hora 15 minutos
Límite de Tiempo
Splunk169 preguntas de práctica
Descripción y detalles del examen
Splunk Certified Cybersecurity Defense Analyst exam covering SOC workflows, threat detection, incident response, and security analytics with Splunk. Administered by Splunk. Key domains include Defenses, Data Sources, and SIEM Best Practices, Investigation, Event Handling, Correlation, and Risk, SPL and Efficient Searching and Threat and Attack Types, Motivations, and Tactics. The exam consists of 66 questions over 75 minutes.
Preguntas de Muestra
Elige una respuesta y consulta la explicación para ver cómo funciona la práctica.
Threat and Attack Types, Motivations, and Tactics
A public web server is repeatedly probed for one CVE, then a web shell-like file appears and outbound connections begin. Which attack vector is most likely?
Threat and Attack Types, Motivations, and Tactics
Endpoint logs show mshta launching script content from a user profile after a phishing message, followed by outbound beaconing. Which description is most accurate?
SPL and Efficient Searching
A search needs unique destination count per user and total event count per user. Which stats functions fit?
Investigation, Event Handling, Correlation, and Risk
A risk analysis view shows 12 contributing events for user jlee over four hours. What should the analyst do first?
Defenses, Data Sources, and SIEM Best Practices
During identity triage, user appears as email in one source and sAMAccountName in another. Which control improves correlation?
Oportunidades profesionales y salario
Salario medio:
$129,180mercado de EE. UU.– Information Security Analysts
Information Security Analysts
Los rangos son cifras del mercado de EE. UU. salvo que se muestre un rango local.
Qué temas cubre este examen
Usa las ponderaciones publicadas de los dominios para planificar tu estudio. Los resultados de práctica no predicen tu puntuación en el examen de certificación.
01Defenses, Data Sources, and SIEM Best Practices
Temas
- Identify common types of cyber defense systems, analysis tools and the most useful data sources for threat analysis.
- Describe SIEM best practices and basic operation concepts of Splunk Enterprise Security, including the interaction between CIM, Data Models and acceleration, Asset and Identity frameworks, and common CIM fields that may be used in investigations.
- Describe how Splunk Security Essentials and Splunk Enterprise Security can be used to assess data sources, including common sourcetypes for on-prem and cloud based deployments and how to find content for a given sourcetype.
Objetivos de aprendizaje
- Identify common types of cyber defense systems, analysis tools and the most useful data sources for threat analysis.
- Describe SIEM best practices and basic operation concepts of Splunk Enterprise Security, including the interaction between CIM, Data Models and acceleration, Asset and Identity frameworks, and common CIM fields that may be used in investigations.
- Describe how Splunk Security Essentials and Splunk Enterprise Security can be used to assess data sources, including common sourcetypes for on-prem and cloud based deployments and how to find content for a given sourcetype.
02Investigation, Event Handling, Correlation, and Risk
Temas
- Describe continuous monitoring and the five basic stages of investigation according to Splunk.
- Explain the different types of analyst performance metrics such as MTTR and dwell time.
- Demonstrate ability to recognize common event dispositions and correctly assign them.
- Define terms and aspects of Splunk Enterprise Security and their uses including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events.
- Identify common built-in dashboards in Enterprise Security and the basic information they contain.
- Understand and explain the essentials of Risk Based Alerting, the Risk framework and creating correlation searches within Enterprise Security.
Objetivos de aprendizaje
- Describe continuous monitoring and the five basic stages of investigation according to Splunk.
- Explain the different types of analyst performance metrics such as MTTR and dwell time.
- Demonstrate ability to recognize common event dispositions and correctly assign them.
- Define terms and aspects of Splunk Enterprise Security and their uses including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events.
- Identify common built-in dashboards in Enterprise Security and the basic information they contain.
- Understand and explain the essentials of Risk Based Alerting, the Risk framework and creating correlation searches within Enterprise Security.
03SPL and Efficient Searching
Temas
- Explain common SPL terms and how they can be used in security analysis, including TSTATS, TRANSACTION, FIRST/LAST, REX, EVAL, FOREACH, LOOKUP, and MAKERESULTS.
- Give examples of Splunk best practices for composing efficient searches.
- Identify SPL resources included within ES, Splunk Security Essentials, and Splunk Lantern.
Objetivos de aprendizaje
- Explain common SPL terms and how they can be used in security analysis, including TSTATS, TRANSACTION, FIRST/LAST, REX, EVAL, FOREACH, LOOKUP, and MAKERESULTS.
- Give examples of Splunk best practices for composing efficient searches.
- Identify SPL resources included within ES, Splunk Security Essentials, and Splunk Lantern.
04Threat and Attack Types, Motivations, and Tactics
Temas
- Recognize common types of attacks and attack vectors.
- Define common terms including supply chain attack, ransomware, registry, exfiltration, social engineering, DoS, DDoS, bot and botnet, C2, zero trust, account takeover, email compromise, threat actor, APT, adversary.
- Identify the common tiers of Threat Intelligence and how they might be applied to threat analysis.
- Outline the purpose and scope of annotations within Splunk Enterprise Security.
- Define tactics, techniques and procedures and how they are regarded in the industry.
Objetivos de aprendizaje
- Recognize common types of attacks and attack vectors.
- Define common terms including supply chain attack, ransomware, registry, exfiltration, social engineering, DoS, DDoS, bot and botnet, C2, zero trust, account takeover, email compromise, threat actor, APT, adversary.
- Identify the common tiers of Threat Intelligence and how they might be applied to threat analysis.
- Outline the purpose and scope of annotations within Splunk Enterprise Security.
- Define tactics, techniques and procedures and how they are regarded in the industry.
05The Cyber Landscape, Frameworks, and Standards
Temas
- Summarize the organization of a typical SOC and the tasks belonging to Analyst, Engineer and Architect roles.
- Recognize common cyber industry controls, standards and frameworks and how Splunk incorporates those frameworks.
- Describe key security concepts surrounding information assurance including confidentiality, integrity and availability and basic risk management.
Objetivos de aprendizaje
- Summarize the organization of a typical SOC and the tasks belonging to Analyst, Engineer and Architect roles.
- Recognize common cyber industry controls, standards and frameworks and how Splunk incorporates those frameworks.
- Describe key security concepts surrounding information assurance including confidentiality, integrity and availability and basic risk management.
06Threat Hunting and Remediation
Temas
- Identify threat hunting techniques including configuration, modeling (anomalies), indicators, and behavioral analytics.
- Define long tail analysis, outlier detection, and some common steps of hypothesis hunting with Splunk.
- Determine when to use adaptive response actions and configure them as needed.
- Explain the use of SOAR playbooks and list the basic ways they can be triggered from Enterprise Security.
Objetivos de aprendizaje
- Identify threat hunting techniques including configuration, modeling (anomalies), indicators, and behavioral analytics.
- Define long tail analysis, outlier detection, and some common steps of hypothesis hunting with Splunk.
- Determine when to use adaptive response actions and configure them as needed.
- Explain the use of SOAR playbooks and list the basic ways they can be triggered from Enterprise Security.
Preguntas Frecuentes
¿No ves tu examen?
Crea un examen de práctica con tu propio material de estudio.