SPLK-5002 Practice Test

A company wants to implement risk-based detection for privileged account activities.

Whatshould they configure first?

A. Asset and identity information for privileged accounts

B. Correlation searches with low thresholds

C. Event sampling for raw data

D. Automated dashboards for all accounts

A security analyst needs to update the SOP for handling phishing incidents.

What should they prioritize?

A. Ensuring all reports are manually verified by analysts

B. Automating the isolation of suspected phishing emails

C. Documenting steps for user awareness training

D. Reporting incidents to the executive board immediately

What are key benefits of using summary indexing in Splunk? (Choose two)

A. Reduces storage space required for raw data

B. Improves search performance on aggregated data

C. Provides automatic field extraction during indexing

D. Increases data retention period

What is the primary function of summary indexing in Splunk reporting?

A. Storing unprocessed log data

B. Creating pre-aggregated data for faster reporting

C. Normalizing raw data for analysis

D. Enhancing the accuracy of alerts

What methods improve the efficiency of Splunk’s automation capabilities? (Choose three)

A. Using modular inputs

B. Optimizing correlation search queries

C. Leveraging saved search acceleration

D. Implementing low-latency indexing

E. Employing prebuilt SOAR playbooks