Question 1

Which term refers to malicious software that encrypts files and demands payment for their release?

Options :

A : Spyware

B : Ransomware

C : Adware

D : Rootkit

Answer: B

Question 2

What is the purpose of the CIM (Common Information Model) in Splunk?

Options :

A : To automate security incident response

B : To encrypt sensitive information in logs

C : To provide a standard framework for organizing and normalizing data

D : To generate visualizations for data analysis

Answer: C

Question 3

Which SPL command is used to filter results based on specific conditions?

Options :

A : filter

B : match

C : search

D : where

Answer: C

Question 4

How does Splunk Enterprise Security utilize risk scores to prioritize security alerts?

Options :

A : By ignoring risk scores and treating all alerts equally

B : By setting a fixed risk score threshold for all alerts

C : By randomizing risk scores for each alert

D : By assigning higher scores to alerts with potential impact and likelihood of occurrence

Answer: D

Question 5

Which of the Enterprise Security frameworks provides additional automatic context and correlation to fields that exist within raw data?

Options :

A : Asset and Identity

B : Threat Intelligence

C : Adaptive Response

D : Risk

Answer: A