Splunk Certified Data Analyst Feed

Question

What is the primary responsibility of a Tier 1 SOC analyst?

Splunk Scda Cyber Landscape Frameworks Standards

Question · Easy

Question

Which part of the CIA triad is concerned with preventing unauthorized modification of data?

Splunk Scda Cyber Landscape Frameworks Standards

Question · Easy

Question

Which framework is most useful when an analyst wants to describe adversary behavior as tactics and techniques?

Splunk Scda Cyber Landscape Frameworks Standards

Question · Medium

Podcast

Tech Exam Prep Podcast

Listen on Spotify

Podcast

Question

When prioritizing a security risk, which pair of factors is most commonly used to estimate overall risk level?

Splunk Scda Cyber Landscape Frameworks Standards

Question · Medium

Question

An organization wants an externally certifiable standard for its information security management system. Which option best fits that goal?

Splunk Scda Cyber Landscape Frameworks Standards

Question · Hard

Question

Which attack type most commonly uses deceptive emails to trick users into clicking links or revealing credentials?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Easy

Question

A working piece of code that abuses a vulnerability is called what?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Easy

Question

Which statement best describes an insider threat?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Easy

Question

Why are TTPs often more durable detection anchors than a single malicious IP address?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Medium

Question

Which threat intelligence tier is most appropriate for executives making long-term risk and investment decisions?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Medium

Question

An attacker tests large lists of stolen username and password pairs against many accounts. What attack is this?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Medium

Question

Dumping credentials from a system's memory most directly maps to which MITRE ATT&CK tactic?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Medium

Question

Which statement best distinguishes a worm from a trojan?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Medium

Question

Why do living-off-the-land techniques often complicate detection?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Hard

Question

An adversary steals data and then encrypts systems to pressure the victim into paying. What is this commonly called?

Splunk Scda Threat Attack Types Motivations Tactics

Question · Hard

Question

Which control is designed to sit inline and actively block malicious network traffic?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Easy

Question

Which data source is most useful for seeing detailed process creation on Windows endpoints?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Easy

Question

What is the main purpose of mapping security data to the Splunk Common Information Model?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Easy

Question

What does the asset and identity framework primarily add to security investigations in Splunk ES?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Easy

Question

Which data source is most important when investigating repeated failed logins against a remote access portal?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Medium

Question

Why is it valuable to ingest both DNS and proxy logs into a SIEM?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Medium

Question

What is a key benefit of using accelerated data models with tstats in Splunk?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Medium

Question

How can Splunk Security Essentials help before a team enables a large set of detections?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Medium

Question

A new firewall sourcetype was onboarded yesterday. Before enabling many correlation searches that depend on it, what should be validated first?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Hard

Question

The same employee appears in logs as CORP\\jsmith, jsmith@example.com, and j.smith. Which Splunk ES capability most directly helps unify that context for investigations?

Splunk Scda Defenses Data Sources Siem Best Practices

Question · Hard

Question

What is the best first step when triaging a newly generated security alert?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Easy

Question

If an analyst confirms that an alert reflects real malicious activity, which event disposition is most appropriate?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Easy

Question

In Splunk Enterprise Security, what is a notable event?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Easy

Question

What is the main purpose of the Incident Review workflow in Splunk ES?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Medium

Question

Which Splunk ES view is designed to provide context around a host or user during an investigation?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Medium

Question

Why are annotations such as MITRE ATT&CK mappings useful on detection content?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Medium

Question

What is the core idea behind risk-based alerting in Splunk ES?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Medium

Question

What does the metric mean time to triage measure?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Medium

Question

A user and their workstation each accumulate several low-severity risk events, but no single event is urgent alone. Which approach best turns that pattern into a stronger analytic?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Hard

Question

A correlation search keeps firing on an approved vulnerability scanner and analysts repeatedly mark those alerts benign. What is the best long-term action?

Splunk Scda Investigation Event Handling Correlation Risk

Question · Hard

Question

Which SPL search correctly returns event counts by sourcetype?