SPLK-5001 Practice Questions

A Cyber Threat Intelligence (CTI) team produces a report detailing a specific threat actor’s typical behaviors and intent. This would be an example of what type of intelligence?

A network security tool that continuously monitors a network for malicious activity and takes action to block it is known as which of the following?

During an investigation it is determined that an event is suspicious but expected in the environment. Out of the following, what is the best disposition to apply to this event?

Which of the following is not considered an Indicator of Compromise (IOC)?

According to David Bianco's Pyramid of Pain, which indicator type is least effective when used in continuous monitoring?

Which stage of continuous monitoring involves adding data, creating detections, and building drilldowns?

An adversary uses "LoudWiner" to hijack resources for crypto mining. What does this represent in a TTP framework?

In which phase of the Continuous Monitoring cycle are suggestions and improvements typically made?

An analyst notices that one of their servers is sending an unusually large amount of traffic, gigabytes more than normal, to a single system on the Internet. There doesn’t seem to be any associated increase in incoming traffic.

What type of threat actor activity might this represent?

An analysis of an organization’s security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of implementing the new process or solution that was selected?