Online Access Free SPLK-5002 Exam Questions

Which of the following is a methodology to help prevent malicious lateral movement?

• A.Zero Trust
• B.MITRE ATT&CK
• C.Lockheed Martin Cyber Kill Chain
• D.Breakglass

A cyber defense engineer plays a role in maintaining a secure SOAR Cloud configuration. Which network security statement is correct about SOAR Cloud?

• A.The Automation Broker initiates an outbound SSL connection to Splunk Cloud, and also initiates an outbound connection to the managed endpoints.
• B.The Automation Broker initiates an outbound SSL connection to Splunk Cloud, and the managed endpoint initiates an outbound connection to the Automation Broker.
• C.The Automation Broker initiates an inbound SSL connection to Splunk Cloud, and also initiates an outbound connection to the managed endpoints.
• D.Splunk Cloud initiates an outbound SSL connection to both the Automation Broker and managed endpoints.

If a correlation search cannot be run at the configured time, which scheduling option should an engineer use to ensure there are no backfill gaps in data?

• A.Real-time
• B.Default
• C.Auto
• D.Continuous

What should a security engineer prioritize when building a new security process?

• A.Automating all workflows within the process
• B.Ensuring it aligns with compliance requirements
• C.Reducing the overall number of employees required
• D.Integrating it with legacy systems

An engineer has been working on building a new automation for the SOC. What Scope should be selected in the SOAR Playbook Debugger during the playbook development to ensure consistency?

• A.New Events
• B.New Artifacts
• C.All Events
• D.All Artifacts