NO.30 The following list contains examples of Tactics, Techniques, and Procedures (TTPs):
1. Exploiting a remote service
2. Lateral movement
3. Use EternalBlue to exploit a remote SMB server
In which order are they listed below?

NO.31 What is the main difference between hypothesis-driven and data-driven Threat Hunting?

NO.32 An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?

NO.33 A Cyber Threat Intelligence (CTI) team delivers a briefing to the CISO detailing their view of the threat landscape the organization faces. This is an example of what type of Threat Intelligence?

NO.34 Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server’s access log has the same log entry millions of times:
147.186.119.200 – – [28/Jul/2023:12:04:13 -0300] “GET /login/ HTTP/1.0” 200 3733 What kind of attack is occurring?

NO.35 Which of the following is not considered an Indicator of Compromise (IOC)?

NO.36 Which of the Enterprise Security frameworks provides additional automatic context and correlation to fields that exist within raw data?

NO.37 Which of the following is not a component of the Splunk Security Content library (ESCU, SSE)?

NO.38 Which of the following is a best practice when creating performant searches within Splunk?

NO.39 Which of the following is a correct Splunk search that will return results in the most performant way?

NO.40 Splunk Enterprise Security has numerous frameworks to create correlations, integrate threat intelligence, and provide a workflow for investigations. Which framework raises the threat profile of individuals or assets to allow identification of people or devices that perform an unusual amount of suspicious activities?

NO.41 Which pre-packaged app delivers security content and detections on a regular, ongoing basis for Enterprise Security and SOAR?

NO.42 When searching in Splunk, which of the following SPL commands can be used to run a subsearch across every field in a wildcard field list?

NO.43 A successful Continuous Monitoring initiative involves the entire organization. When an analyst discovers the need for more context or additional information, perhaps from additional data sources or altered correlation rules, to what role would this request generally escalate?

NO.44 Which of the following is the primary benefit of using the CIM in Splunk?

NO.45 Which of the following data sources can be used to discover unusual communication within an organization’s network?

NO.46 According to Splunk CIM documentation, which field in the Authentication Data Model represents the user who initiated a privilege escalation?

NO.47 An IDS signature is designed to detect and alert on logins to a certain server, but only if they occur from 6:00 PM – 6:00 AM. If no IDS alerts occur in this window, but the signature is known to be correct, this would be an example of what?