What does 'SIEM' stand for?

Security Information & Event Management

studbud

CySA+ Chapter 1 Questions

30 termsStudBud Administration17 plays

Imported from external platform

Flashcards30 cardsFPractice quizPHost liveL

Questions 30

Answers

1
What does Splunk primarily do?
User monitoring
Data analysis
Threat hunting
Log aggregation
All the answrees
Asset management
2
Best metric for process improvement?
Time to respond
Patch cycle time
Incident rate
Time to detect
None apply
All are important
3
Best indicator of SecOps maturity?
Staff training levels
Response time
Audit outcomes
Incident documentation
Best indicator of SecOps maturity?
Patching frequency
4
Splunk’s main data input is?
Database records
API data
Network flows
Log files
All the answres
User input
5
A key part of a vuln report?
User impact
Historical data
Vendor contacts
Patch instructions
Affected assets
Exploit code
6
How does Splunk handle scale?
Manual resizing
Data sharding
Fixed storage
Cloud-only
Load balancing
Single-node setup
7
What is a false positive in vuln mgmt?
Accurate threat detection
Unpatched vuln
Incorrectly identified vuln
Missed detection
8
What is chain of custody?
Patch management routine
Incident response protocol
Asset inventory technique
Forensic analysis step
Evidence handling process
Security monitoring method
9
What defines a 'critical' vuln?
Ease of exploitation
High impact if exploited
All factors considered
Vendor acknowledgment
Network exposure
Public awareness
10
Main role of a SOC analyst?
Incident investigation
Hardware maintenance
Software programming
User training
Policy development
Network design
11
What is Splunk's SPL?
Splunk Programming Language
Splunk Powerful Language
Splunk Query Language
Splunk Pipeline Language
Splunk Processing Language
Splunk Performance Language
12
Primary goal of vuln scanning?
Patch management
None of the answers
Compliance check
Inventory assets
All of the answers
Find weaknesses
13
Vuln scan frequency should be?
As needed
Quarterly
Weekly
Daily
Monthly
Annually
14
Primary use of Splunk Forwarders?
Performance monitoring
Log deletion
User authentication
Data collection
Data filtering
Data routing
15
Key benefit of automating reports?
Reduce costs
Improve accuracy
Save time & Improve accuracy
All the answers
Enhance security
Save time
16
How to extend Splunk’s capabilities?
Network expansions
Hardware upgrades
Database indexing
Splunk Apps
Additional servers
User permissions
17
When to perform credentialed scans?
Rarely
During audits
As per policy
Often
Only externally
Only after incidents
18
Splunk alerts can be triggered by?
Data patterns
Search results
User logins
Storage levels
Time schedules
All the answers
19
Main use of Splunk dashboards?
Data export
User management
Data input
Log storage
Incident reporting
Real-time monitoring
20
Splunk can index what type of data?
Binary files
Machine data
Structured data
Text files
Web pages
Sensor outputs
21
Splunk's data models support?
No data storage
Semi-structured data
All data types
Structured data only
External data
Unstructured data only
22
What does 'SIEM' stand for?
Security Information & Event Management
Secure Internet Email Manager
System Incident Email Monitor
System Information & Event Monitoring
Security Incident Event Manager
Security Information Event Manager
23
Splunk's core feature is?
Password management
System restarts
Network control
Code deployment
Data indexing
Data backup
24
Vuln scans are ineffective without?
Proper configuration
Executive support
Large teams
Cloud access
High budget
Regular updates
25
Splunk’s primary visualization tool?
Graphs
Maps
Charts
Reports
Tables
Dashboards
26
First step in vuln management?
Threat modeling
Remediation
Asset identification
Patching
Scanning
Risk assessment
27
Best practice for Splunk search?
Ignore errors
Use wildcards
Skip filters
Broad terms
Specific terms
Time range narrow
28
Why are SOPs crucial in SecOps?
Simplify training
All the answers
Maintain consistency
Ensure compliance
Reduce errors
None of the answers
29
Splunk saves searches as?
Reports
Events
Snapshots
Triggers
Tokens
Signals
30
What optimizes SecOps processes?
Encryption use
Automated tools
Vendor selection
Regular audits
Cross-training
Physical security

CySA+ Chapter 1 Questions Flashcards | StudBud

CySA+ Chapter 1 Questions

30 termsStudBud Administration17 plays

Imported from external platform

Flashcards30 cardsFPractice quizPHost liveL

Questions 30

Answers

1
What does Splunk primarily do?
User monitoring
Data analysis
Threat hunting
Log aggregation
All the answrees
Asset management
2
Best metric for process improvement?
Time to respond
Patch cycle time
Incident rate
Time to detect
None apply
All are important
3
Best indicator of SecOps maturity?
Staff training levels
Response time
Audit outcomes
Incident documentation
Best indicator of SecOps maturity?
Patching frequency
4
Splunk’s main data input is?
Database records
API data
Network flows
Log files
All the answres
User input
5
A key part of a vuln report?
User impact
Historical data
Vendor contacts
Patch instructions
Affected assets
Exploit code
6
How does Splunk handle scale?
Manual resizing
Data sharding
Fixed storage
Cloud-only
Load balancing
Single-node setup
7
What is a false positive in vuln mgmt?
Accurate threat detection
Unpatched vuln
Incorrectly identified vuln
Missed detection
8
What is chain of custody?
Patch management routine
Incident response protocol
Asset inventory technique
Forensic analysis step
Evidence handling process
Security monitoring method
9
What defines a 'critical' vuln?
Ease of exploitation
High impact if exploited
All factors considered
Vendor acknowledgment
Network exposure
Public awareness
10
Main role of a SOC analyst?
Incident investigation
Hardware maintenance
Software programming
User training
Policy development
Network design
11
What is Splunk's SPL?
Splunk Programming Language
Splunk Powerful Language
Splunk Query Language
Splunk Pipeline Language
Splunk Processing Language
Splunk Performance Language
12
Primary goal of vuln scanning?
Patch management
None of the answers
Compliance check
Inventory assets
All of the answers
Find weaknesses
13
Vuln scan frequency should be?
As needed
Quarterly
Weekly
Daily
Monthly
Annually
14
Primary use of Splunk Forwarders?
Performance monitoring
Log deletion
User authentication
Data collection
Data filtering
Data routing
15
Key benefit of automating reports?
Reduce costs
Improve accuracy
Save time & Improve accuracy
All the answers
Enhance security
Save time
16
How to extend Splunk’s capabilities?
Network expansions
Hardware upgrades
Database indexing
Splunk Apps
Additional servers
User permissions
17
When to perform credentialed scans?
Rarely
During audits
As per policy
Often
Only externally
Only after incidents
18
Splunk alerts can be triggered by?
Data patterns
Search results
User logins
Storage levels
Time schedules
All the answers
19
Main use of Splunk dashboards?
Data export
User management
Data input
Log storage
Incident reporting
Real-time monitoring
20
Splunk can index what type of data?
Binary files
Machine data
Structured data
Text files
Web pages
Sensor outputs
21
Splunk's data models support?
No data storage
Semi-structured data
All data types
Structured data only
External data
Unstructured data only
22
What does 'SIEM' stand for?
Security Information & Event Management
Secure Internet Email Manager
System Incident Email Monitor
System Information & Event Monitoring
Security Incident Event Manager
Security Information Event Manager
23
Splunk's core feature is?
Password management
System restarts
Network control
Code deployment
Data indexing
Data backup
24
Vuln scans are ineffective without?
Proper configuration
Executive support
Large teams
Cloud access
High budget
Regular updates
25
Splunk’s primary visualization tool?
Graphs
Maps
Charts
Reports
Tables
Dashboards
26
First step in vuln management?
Threat modeling
Remediation
Asset identification
Patching
Scanning
Risk assessment
27
Best practice for Splunk search?
Ignore errors
Use wildcards
Skip filters
Broad terms
Specific terms
Time range narrow
28
Why are SOPs crucial in SecOps?
Simplify training
All the answers
Maintain consistency
Ensure compliance
Reduce errors
None of the answers
29
Splunk saves searches as?
Reports
Events
Snapshots
Triggers
Tokens
Signals
30
What optimizes SecOps processes?
Encryption use
Automated tools
Vendor selection
Regular audits
Cross-training
Physical security