[2026年08月]更新のSPLK-5001試験問題と有効なSPLK-5001問題集PDF
SPLK-5001ブレーン問題集学習ガイドにはヒントとコツで試験合格を目指そう
質問 # 39
Splunk Enterprise Security has numerous frameworks to create correlations, integrate threat intelligence, and provide a workflow for investigations. Which framework raises the threat profile of individuals or assets to allow identification of people or devices that perform an unusual amount of suspicious activities?
- A. Asset and Identity Framework
- B. Notable Event Framework
- C. Threat Intelligence Framework
- D. Risk Framework
正解：D
質問 # 40
Which of the following SPL searches is likely to return results the fastest?
- A. protocol=tcp | stats count
src_ip=1.2.3.4 src_port=2938 protocol=tcp | stats count - B. src_ip=1.2.3.4
index=network src_port=2938 protocol=tcp | stats count by src_ip | - C. search src_ip=1.2.3.4
index=network sourcetype=netflow src_ip=1.2.3.4 src_port=2938 - D. src_port=2938 AND protocol=tcp | stats count by src_ip | search
正解：C
解説：
Chosen option is the most efficient because it restricts the search to a specific index and sourcetype and applies all field filters (src_ip, src_port, protocol) at the very start. This minimizes the volume of data scanned before invoking the lighter-weight stats command, making it faster than searches that leave out index/sourcetype constraints or postpone filtering.
質問 # 41
Which Splunk Enterprise Security framework provides a way to identify incidents from events and then manage the ownership, triage process, and state of those incidents?
- A. Notable Event
- B. Adaptive Response
- C. Investigation Management
- D. Asset and Identity
正解：C
質問 # 42
Splunk detections can be mapped to their appropriate MITRE ATT&CK Techniques using which feature?
- A. Context
- B. Annotations
- C. Threat Intelligence
- D. Correlations
正解：B
解説：
In Splunk Enterprise Security, correlation searches and other detections include annotation fields where you map each detection to its corresponding MITRE ATT&CK tactic and technique IDs.
These Annotations are what drive the ATT&CK mapping in dashboards and reports.
質問 # 43
Which set of behaviors describes an Advanced Persistent Threat (APT) group focused on compromising accounts of senior executives?Phishing with ransomware.
- A. Spam email and scamware.
- B. Spearphishing with a malicious URL.
- C. Distributed Denial of Service (DDoS) with botnets.
- D. Phishing with ransomware.
正解：B
解説：
APTs targeting senior executives typically use highly tailored spearphishing emails containing malicious URLs to compromise high_value accounts, rather than broad phishing campaigns, DDoS attacks, or generic spam.
質問 # 44
In which phase of the Continuous Monitoring cycle are suggestions and improvements typically made?
- A. Define and Predict
- B. Analyze and Report
- C. Implement and Collect
- D. Establish and Architect
正解：B
質問 # 45
The Lockheed Martin Cyber Kill Chain breaks an attack lifecycle into several stages. A threat actor modified the registry on a compromised Windows system to ensure that their malware would automatically run at boot time. Into which phase of the Kill Chain would this fall?
- A. Delivery
- B. Exploitation
- C. Act on Objectives
- D. Installation
正解：D
質問 # 46
A successful Continuous Monitoring initiative involves the entire organization. When an analyst discovers the need for more context or additional information, perhaps from additional data sources or altered correlation rules, to what role would this request generally escalate?
- A. Security Architect
- B. Security Analyst
- C. SOC Manager
- D. Security Engineer
正解：D
質問 # 47
Which of the following use cases is best suited to be a Splunk SOAR Playbook?
A Forming hypothesis for Threat Hunting
B. Visualizing complex datasets.
C. Creating persistent field extractions.
D. Taking containment action on a compromised host
正解：
解説：
D
質問 # 48
An analyst investigates an IDS alert and confirms suspicious traffic to a known malicious IP. What Enterprise Security data model would they use to investigate which process initiated the network connection?
- A. Endpoint
- B. Network traffic
- C. Web
- D. Authentication
正解：A
質問 # 49
An adversary uses "LoudWiner" to hijack resources for crypto mining. What does this represent in a TTP framework?
- A. Technique
- B. Tactic
- C. Procedure
- D. Problem
正解：C
質問 # 50
When searching in Splunk, which of the following SPL commands can be used to run a subsearch across every field in a wildcard field list?
- A. rex
- B. transaction
- C. makeresults
- D. foreach
正解：D
質問 # 51
While investigating a malware incident, an analyst is unable to determine the host name from the network logs. What feature of Enterprise Security most likely needs to be updated?
- A. Malware Center
- B. Data Models
- C. Assets & Identities
- D. Identity Center
正解：C
解説：
Assets & Identities in Splunk Enterprise Security enrich events with contextual information such as host names, IP addresses, and user identities. If an analyst cannot determine the host name from network logs, it likely means the Assets (e.g., IP-to-hostname mappings) are incomplete or outdated and need to be updated.
質問 # 52
Which Splunk ES feature detects complex behavior over a "period of time" instead of "point in time" alerting?
- A. Notable Based Alerting (NBA)
- B. Risk Based Alerting (RBA)
- C. Analytic Stories
- D. Adaptive Actions
正解：B
解説：
Risk Based Alerting evaluates and accumulates risk scores for entities over a defined time window, enabling detection of evolving threats across a period rather than at a single point in time.
質問 # 53
Refer to the exibit.
An analyst is building a search to examine Windows XML Event Logs, but the initial search is not returning any extracted fields. Based on the above image, what is themost likelycause?
- A. The analyst is searching newly indexed data that was improperly parsed.
- B. The analyst does not have the proper role to search this data.
- C. The analyst did not add the excract command to their search pipeline.
- D. The analyst is not in the Drooer Search Mode and should switch to Smart or Verbose.
正解：D
質問 # 54
What phase of the continuous monitoring cycle might include the creation of an after action report highlighting the findings and recommendations for the next phase of the cycle?
- A. Analyze and Report
- B. Define and Predict
- C. Establish and Architect
- D. Respond and Review
正解：D
解説：
The Respond and Review phase encompasses not only taking corrective actions but also compiling an after-action report that documents findings and recommendations, feeding insights back into the next cycle iteration.
質問 # 55
In Splunk Enterprise Security, annotations can be added to enrich correlation search results with security framework mappings. Which of the following security frameworks is not available as a default annotation option?
- A. Lockheed Martin Cyber Kill Chain
- B. OWASP Top 10
- C. MITRE ATT&CK
- D. CIS
正解：B
質問 # 56
Which Splunk Enterprise Security framework provides a way to identify incidents from events and then manage the ownership, triage process, and state of those incidents?
- A. Notable Event
- B. Adaptive Response
- C. Investigation Management
- D. Asset and Identity
正解：C
解説：
The Investigation Management framework in Splunk ES takes notable events and creates incidents, then provides the workflows and tools to assign ownership, track triage progress, and manage incident states from open through resolution.
質問 # 57
Which of the following compliance frameworks was specifically created to measure the level of cybersecurity maturity within an organization?
- A. FISMA
- B. CMMC
- C. PCI-DSS
- D. GDPR
正解：B
解説：
The Cybersecurity Maturity Model Certification (CMMC) was designed to assess and certify an organization's cybersecurity maturity across defined levels, ensuring progressive improvement in security practices. Other frameworks like PCI_DSS, GDPR, and FISMA set requirements but do not define graduated maturity levels.
質問 # 58
An analyst learns that several types of data are being ingested into Splunk and Enterprise Security, and wants to use the metadata SPL command to list them in a search. Which of the following arguments should she use?
- A. | metadata type=hosts
- B. | metadata type=sourcetypes
- C. | metadata type=assets
- D. | metadata type=cim
正解：B
解説：
Using metadata type=sourcetypes returns a list of all sourcetypes currently indexed, which lets the analyst see exactly which data types are being ingested.
質問 # 59
......
SPLK-5001試験問題無料PDFダウンロード 最近更新された問題です：https://www.jpntest.com/shiken/SPLK-5001-mondaishu
SPLK-5001認定試験問題集には144練習テスト問題：https://drive.google.com/open?id=153inTKv9Dm1r9nGxSOnhbfSl3zEpLCFr