A Tier 1 SOC analyst receives a notable event in Splunk Enterprise Security. Which action best matches a Tier 1 analyst's documented role?
Soc Fundamentals
Question · Easy
Which MITRE ATT&CK term describes the high-level adversary objective such as Initial Access or Persistence?
Frameworks
Which Cyber Kill Chain phase covers an attacker establishing remote control of the compromised host?
Tech Exam Prep Podcast
Listen on Spotify
Podcast
A defender is mapping an attack using the Diamond Model. Which four core features must be considered?
Question · Medium
Which of the following is the BEST example of a tactical-level indicator of compromise (IOC)?
Threat Intelligence
Which Splunk feature normalizes data from many sourcetypes so that searches like `tag=authentication action=failure` work consistently across vendors?
Data Management
Which Windows Event ID is most useful for confirming a successful interactive logon?
Data Sources
Which Sysmon Event ID records a process creation including parent process and command line?
An analyst wants to detect outbound DNS tunneling. Which Sysmon Event ID is the most direct source of DNS query data?
Which SPL command computes statistics across the entire result set without grouping rows the way `stats` does?
Spl
An analyst wants to compute a running cumulative count of failed logons per user, ordered in time. Which SPL command should they use?
Which SPL command groups related events into a single multi-value session, useful for stitching a logon to its child process events?
Question · Hard
Which command is the most efficient way to count notable events from accelerated data models in Enterprise Security?
Which SPL clause filters search results AFTER the data has been processed by previous commands such as `stats`?
Which SPL command enriches results by adding fields from a CSV or KV Store lookup file?
Which SPL command converts a delimited single-value field into a multi-value field that can be expanded with `mvexpand`?
Which command should an analyst use to remove duplicate values for a chosen field while keeping the most recent event?
Which SPL command is purely formatting and removes any field not specified, in the order specified?
An analyst wants to create a new field `risk_score` based on whether an event is from a privileged user. Which command should they use?
Which Enterprise Security workflow is triggered when a correlation search matches and creates an item for analysts to investigate?
Enterprise Security
In Splunk Enterprise Security, what is an Adaptive Response action?
Which Enterprise Security feature aggregates risk scores against entities (users, hosts) over time so that a notable triggers only when risk passes a threshold?
Which type of threat hunt starts with an explicit theory like "if attackers are using PsExec for lateral movement, we should see specific service names in 4697 events"?
Threat Hunting
Which metric measures the average time from when a security event occurs to when SOC analysts detect it?
Which Splunk Enterprise Security domain dashboard is the BEST starting point for reviewing failed authentications across data sources?
An ES analyst needs to enrich notable events with the asset's business unit and criticality. Which framework provides this data?
An analyst confirms a notable event is benign business activity. Which Incident Review status best captures the outcome for SOC metrics?
Investigation
Which command would extract a username pattern from a raw event using a regular expression at search time?
Which SPL pair is best for finding all distinct values of a multi-value field with their counts per source?
An analyst wants to detect new processes never seen before per host in the last 30 days. Which technique BEST fits?
Which Kerberos Windows Event ID logs a service ticket request, useful for detecting Kerberoasting?
Which Sysmon Event ID would most directly help detect process injection via a remote thread?
Which CIM data model would an analyst search for failed logon events using `tstats`?
Which CIM field consistently identifies the source host of an event regardless of vendor?
Which Splunk component is a lightweight agent installed on endpoints that forwards data to indexers?
Splunk Architecture
Which Cyber Kill Chain phase typically maps to a phishing email being opened by the user, executing a macro?
Which MITRE ATT&CK tactic covers techniques like Brute Force and Credential Dumping?
An analyst sees `lsass.exe` accessed by `mimikatz.exe` in Sysmon Event 10 (ProcessAccess) with high access mask. Which ATT&CK technique is most likely?
Which type of threat intelligence describes broad adversary motivations and is typically consumed by executives?
Which Splunk feature lets an analyst attach evidence (events, notes, file artifacts) to an active investigation timeline?
Which SPL function returns the first non-null argument, useful when normalizing a username field with multiple possible source fields?
An analyst is hunting for unusual PowerShell activity. Which combination of fields is MOST useful in 4688 / Sysmon 1 events?
Which category of search runs continuously on a schedule and creates notable events when its conditions match?
Which Linux subsystem is typically the source of normalized authentication and command-execution events ingested into Splunk?
Which type of log is the BEST source to investigate a user's web-based exfiltration through a SaaS app?
When tuning a noisy correlation search, which is the FIRST step a SOC team should take?
An analyst writes `index=auth | stats count by user | where count > 100`. What does this detect?
Loading more…