Exam SPLK-5001 topic 1 question 19 discussion

Actual exam question from Splunk's SPLK-5001

Question #: 19
Topic #: 1

Splunk Enterprise Security has numerous frameworks to create correlations, integrate threat intelligence, and provide a workflow for investigations. Which framework raises the threat profile of individuals or assets to allow identification of people or devices that perform an unusual amount of suspicious activities?

A. Threat Intelligence Framework
B. Risk Framework
C. Notable Event Framework
D. Asset and Identity Framework

Show Suggested Answer

Suggested Answer: B 🗳️

by nosavotor at Sept. 26, 2024, 9:13 p.m.

Comments

Submit Cancel

12la12

4 months, 2 weeks ago

Selected Answer: D

The correct answer is: D. Asset and Identity Framework Explanation: The Asset and Identity Framework is specifically designed to raise the threat profile of individuals (identities) or devices (assets) by correlating events with contextual information. It achieves this by: Enriching raw events with metadata about assets (devices, servers) and identities (users, service accounts). Aggregating suspicious activities tied to specific entities (e.g., repeated failed logins from a user or unusual data transfers from a server). Providing contextual prioritization (e.g., flagging a high-risk activity if it involves a privileged account or a mission-critical server).

upvoted 1 times

...

nosavotor

9 months, 3 weeks ago

Wildcards are not efficient

upvoted 1 times

...