Q46. Which of the following roles is commonly responsible for selecting and designing the infrastructure and tools that a security analyst utilizes to effectively complete their job duties?

Q47. An analyst is looking at Web Server logs, and sees the following entry as the last web request that a server processed before unexpectedly shutting down:
147.186.119.107 – – [28/Jul/2006:10:27:10 -0300] “POST /cgi-bin/shutdown/ HTTP/1.0” 200 3333 What kind of attack is most likely occurring?

Q48. An analyst is examining the logs for a web application’s login form. They see thousands of failed logon attempts using various usernames and passwords. Internet research indicates that these credentials may have been compiled by combining account information from several recent data breaches.
Which type of attack would this be an example of?

Q49. An analyst notices that one of their servers is sending an unusually large amount of traffic, gigabytes more than normal, to a single system on the Internet. There doesn’t seem to be any associated increase in incoming traffic.
What type of threat actor activity might this represent?

Q50. Outlier detection is an analysis method that groups together data points into high density clusters.
Data points that fall outside of these high density clusters are considered to be what?

Q51. When searching in Splunk, which of the following SPL commands can be used to run a subsearch across every field in a wildcard field list?

Q52. Which field is automatically added to search results when assets are properly defined and enabled in Splunk Enterprise Security?

Q53. Which of the following SPL searches is likely to return results the fastest?

Q54. Splunk SOAR uses what feature to automate security workflows so that analysts can spend more time performing analysis and investigation?

Q55. Which Splunk Enterprise Security framework provides a way to identify incidents from events and then manage the ownership, triage process, and state of those incidents?

Q56. An analyst is investigating how an attacker successfully performs a brute-force attack to gain a foothold into an organizations systems. In the course of the investigation the analyst determines that the reason no alerts were generated is because the detection searches were configured to run against Windows data only and excluding any Linux data.
This is an example of what?

Q57. The Lockheed Martin Cyber Kill Chain breaks an attack lifecycle into several stages. A threat actor modified the registry on a compromised Windows system to ensure that their malware would automatically run at boot time. Into which phase of the Kill Chain would this fall?

Q58. What is the main difference between a Denial of Service (DoS) attack and a Distributed Denial of Service (DDoS) attack?

Q59. Which stage of continuous monitoring involves adding data, creating detections, and building drilldowns?

Q60. What is the following step-by-step description an example of?
1. The attacker devises a non-default beacon profile with Cobalt Strike and embeds this within a document.
2. The attacker creates a unique email with the malicious document based on extensive research about their target.
3. When the victim opens this document, a C2 channel is established to the attacker’s temporary infrastructure on a compromised website.