Splunk Certified Cybersecurity Defense Analyst SPLK-5001 Exam Questions

What is the term for a model of normal network activity used to detect deviations?

What is the first phase of the Continuous Monitoring cycle?

A Risk Notable Event has been triggered in Splunk Enterprise Security, an analyst investigates the alert, and determines it is a false positive. What metric would be used to define the time between alert creation and close of the event?

Which dashboard in Enterprise Security would an analyst use to generate a report on users who are currently on a watchlist?

Rotating encryption keys after a security incident is most closely linked to which security concept?

While the top command is utilized to find the most common values contained within a field, a Cyber Defense Analyst hunts for anomalies. Which of the following Splunk commands returns the least common values?

What Splunk feature would enable enriching public IP addresses with ASN and owner information?