Free Splunk SPLK-5002 Exam Questions

Question 1

An engineer is writing a correlation search and needs to use T1059 from MITRE ATT & CK as a fieldin Incident Review. Assuming they are writing a correlation search that does not use the Risk datamodel, which example statement should be appended to the correlation search?

A : The expression assigning T1059 to the correlation search ' s MITRE ATT & CK annotation field.

B : The expression assigning T1059 to an unrelated event field.

C : The expression applying T1059 only through a risk-model field.

D : The expression using a non-annotation field for the ATT & CK technique.

Answer: A

Question 2

An engineer is writing a correlation search and needs to use T1059 from MITRE ATT & CK as a fieldin Incident Review. Assuming they are writing a correlation search that does not use the Risk datamodel, which example statement should be appended to the correlation search?

A : The expression assigning T1059 to the correlation search ' s MITRE ATT & CK annotation field.

B : The expression assigning T1059 to an unrelated event field.

C : The expression applying T1059 only through a risk-model field.

D : The expression using a non-annotation field for the ATT & CK technique.

Answer: A

Question 3

Which fields are used to determine asset priority, when priority is assigned through an asset and identity lookup?

A : dest, src, or dvc

B : dest, src, or tag

C : user or src_user

D : dest_user or src_user

Answer: A

Question 4

An engineer is writing a correlation search and needs to use T1059 from MITRE ATT & CK as a fieldin Incident Review. Assuming they are writing a correlation search that does not use the Risk datamodel, which example statement should be appended to the correlation search?

A : The expression assigning T1059 to the correlation search ' s MITRE ATT & CK annotation field.

B : The expression assigning T1059 to an unrelated event field.

C : The expression applying T1059 only through a risk-model field.

D : The expression using a non-annotation field for the ATT & CK technique.

Answer: A

Question 5

What is the primary purpose of correlation searches in Splunk?

A : To extract and index raw data

B : To identify patterns and relationships between multiple data sources

C : To create dashboards for real-time monitoring

D : To store pre-aggregated search results

Answer: B