What is the FIRST stage of the detection engineering lifecycle in a mature SOC?
Detection Engineering
Question · Easy
In Splunk Enterprise Security, which alert action turns a scheduled correlation search into a notable event for SOC analysts to investigate?
A correlation search is firing 400 notables a day for the same Active Directory service account. Which configuration change reduces noise without disabling the rule?
Question · Medium
Tech Exam Prep Podcast
Listen on Spotify
Podcast
What is the role of risk modifiers in Splunk Enterprise Security's risk-based alerting framework?
Which object in risk-based alerting is responsible for evaluating accumulated risk and creating a single high-fidelity notable when a threshold is crossed?
A new detection idea must be validated before going to production. Which environment ordering is correct in the detection lifecycle?
Which MITRE ATT&CK alignment is the BEST first reference when authoring a new detection for credential dumping?
Which Splunk content source provides curated, ready-to-deploy detections that map to MITRE ATT&CK and are updated regularly?
Which schedule and time-window pair would MOST likely cause a correlation search to miss events that arrive late from a forwarder?
Question · Hard
When should a detection engineer formally retire a correlation search?
A risk-based alerting design assigns risk_score=20 to every event from a single source. What is the main weakness of this approach?
Which artifact is the BEST first input when developing a new detection idea?
A detection author wants the correlation search to run efficiently against years of authentication data. Which command set should they prefer?
Which field in a correlation search result becomes the risk object when you write to the risk index using the Risk Analysis adaptive response action?
A detection has a 30% false-positive rate. Which tuning step is MOST defensible before lowering severity?
Which MITRE ATT&CK Coverage app benefit is MOST relevant to a detection engineer planning quarterly roadmap work?
A team wants to validate a new detection before it is enabled. Which test data approach gives the most defensible result?
What is the purpose of a contributing event in a risk notable?
Which design choice is MOST aligned with reducing alert fatigue while preserving detection coverage?
A risk incident rule fires when a single risk object accumulates score from 3+ different correlation searches within 24h above 80. Which property of this rule is MOST important?
Which Splunk component is responsible for parsing and timestamp extraction at ingestion time?
Data Engineering
Which `props.conf` setting tells Splunk where in the raw event to find the timestamp string?
A new sourcetype splits one logical event into many one-line events. Which `props.conf` setting is the FIRST one to fix?
Which Splunk file pair binds a field-extracting transform to a sourcetype at search time?
Which setting causes structured data such as CSV/JSON to be field-extracted at INDEX time rather than search time?
Which `transforms.conf` attribute is set when you need a search-time extraction to read from a field other than `_raw`?
Which configuration BEST removes credit card numbers from raw events at ingest, before they hit disk?
Which mechanism enriches raw events with HR data such as department and manager, joined on the user field?
Which CIM data model would normalize Windows 4624/4625 logon events for cross-source detections?
Which CIM data model holds firewall, NetFlow, and proxy connection records normalized as `src`, `dest`, `bytes_in`, `bytes_out`?
Which Splunk Add-on type is officially supplied by the data source vendor or Splunk to onboard a new product into CIM?
After accelerating the Authentication data model, which command should detection authors use to query it efficiently?
Which framework in Splunk Enterprise Security joins risk and notable events to business-context information for hosts and users?
An engineer adds a new firewall sourcetype but events arrive with `_time` set to the indexing time, not the event time. Which props.conf settings are MOST likely misconfigured?
Which CIM data model BEST normalizes process creation events from EDR or Sysmon Event ID 1?
Which `transforms.conf` flag must be set when defining an indexed field extraction (custom field stored at index time)?
Which calculated field configuration is correct in `props.conf`?
What is the recommended order of search-time knowledge object processing for normalizing a new source to CIM?
An accelerated data model shows `Range = 30 days` but searches at 60 days are slow. What is the MOST likely fix?
A new TA is installed but events still show `sourcetype=fortigate` instead of `fortigate_traffic`. Which configuration is MOST likely missing?
Which step of an incident response plan focuses on stopping the spread of an attacker once an incident is confirmed?
Security Processes
Which SOC KPI measures the time between event occurrence and detection by the SOC?
Which framework in Splunk Enterprise Security is responsible for matching observables (IPs, domains, hashes) against curated indicators of compromise?
Which Splunk index, by default, stores normalized threat intelligence indicators ready for correlation?
Which CIS Critical Security Control is MOST directly supported by a CIM-normalized inventory of hardware and software assets fed into the asset framework?
Which incident response phase produces the after-action report and feeds improvements back into detections and playbooks?
Which escalation criterion is BEST suited for an SLA-driven SOC?
Loading more…