SPLK-5002 試験問題を無料オンラインアクセス

A new playbook needs to be developed for automated phishing analysis and response. Configured in SOAR are integrations with Splunk Enterprise Security and actions from assets that pull in user- reported emails, perform automated threat analysis, add blocks on the proxy, and an EDR vendor to take various actions. Which would be the best workflow for the new playbook?

• A.Ingest the email from the mail vendor
  Detonate email in the automated threat analysis system and collect verdict, looking for malicious indicators Search the mail system for all users that received the email Block any malicious URLs and processes with the proxy and EDR solutions
• B.Ingest the email from the mail vendor
  Detonate email in the automated threat analysis system and collect verdict, looking for malicious indicators Search the mail system for all users that received the email Block all URLs and processes with the proxy and EDR solutions
• C.Submit the email from Splunk Enterprise Security
  Search the mail system for all users that received the email
  Review results from the automated threat analysis
  Block any malicious URLs and processes with the proxy and EDR solutions
• D.Submit the user reported email from Splunk Enterprise Security
  Search the mail system for all users that received the email
  Review results from the automated threat analysis
  Block any malicious URLs and processes with the proxy and EDR solutions

When using SOAR to automate a response with a zero trust approach, which of the following represents a valid order of operations?

• A.Observe, orient, decide, act
• B.Contain, triage initial incident, identify scope, remediate and/or restore
• C.Identify, scope, remediate and/or restore, triage
• D.Triage initial incident, identify scope, contain, remediate and/or restore

The SOC manager has a desire to measure mean time to acknowledge finding (notable event) in order to meet a desired service-level objective. Which two fields can be used to measure the difference?

• A.Severity, Owner
• B.User, Status
• C.Urgency, Status
• D.Status, Owner

Which practices strengthen the development of Standard Operating Procedures (SOPs)? (Choose three)

• A.Excluding historical incident data
• B.Collaborating with cross-functional teams
• C.Including detailed step-by-step instructions
• D.Focusing solely on high-risk scenarios
• E.Regular updates based on feedback

Which features are crucial for validating integrations in Splunk SOAR? (Choose three)

• A.Testing API connectivity
• B.Evaluating automated action performance
• C.Verifying authentication methods
• D.Monitoring data ingestion rates
• E.Increasing indexer capacity