Discuss Splunk SPLK-3003 Exam Topic 6 Question 10

Consider the search shown below.

What is this search's intended function?

ATo return all the web_log events from the web index that occur two hours before and after the most recent high severity, denied event found in the firewall index.

BTo find all the denied, high severity events in the firewall index, and use those events to further search for lateral movement within the web index.

CTo return all the web_log events from the web index that occur two hours before and after all high severity, denied events found in the firewall index.

DTo search the firewall index for web logs that have been denied and are of high severity.

Suggested Answer: C

Get Premium SPLK-3003 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

18 comments · newest first

Eve 10 months ago

D is definitely off, no way it's that simple.

Enola 10 months ago

Wait, are we really looking at two hours before and after? That seems a bit much!

Elly 11 months ago

C seems accurate too, but not sure about the "all" part.

Malcolm 11 months ago

I think it's B, that makes more sense for lateral movement.

Danica 11 months ago

Looks like it's option A, right?

Vanda 11 months ago

I feel pretty confident about this. I'll review the search syntax and the description of each option to determine the intended function.

Tawny 12 months ago

This is a tricky one. I'm going to make sure I understand the difference between the options before making my choice. The details in the question are important.

Dan 12 months ago

Okay, I think I've got it. The key is understanding that the search is looking at both the web index and the firewall index. I'll focus on that relationship when selecting my answer.

Jovita 12 months ago

Hmm, I'm a bit confused by the wording of the options. I'll need to re-read the question and think through the logic of each choice.

Noel 1 year ago

This looks like a pretty straightforward question. I'd carefully read through the options and try to visualize what each search is doing.

Xochitl 1 year ago

I thought it was about lateral movement, which makes me lean towards option B, but I can't recall the exact details from my notes.

Howard 1 year ago

I feel like option C makes sense because it mentions all high severity denied events, but I'm a bit confused about the time frame part.

Aleshia 1 year ago

I remember a practice question that was similar, and I think it was about finding events within a specific time frame. Maybe it's option A?

Dallas 1 year ago

I think the search is trying to find web logs related to high severity denied events, but I'm not sure if it's just the most recent ones or all of them.

Christiane 1 year ago

Okay, I remember learning about proxy firewalls in class. I believe the key is understanding how they work to protect the network.

Ruby 1 year ago

Acceptance criteria - that's the key to verifying user stories, right? I'm pretty confident I can identify the correct statement here.

Jacob 1 year ago

This seems like a pretty straightforward question. The planning phase is critical because it sets the foundation for the entire RBAC implementation.

Billy 1 year ago

That sounds similar to a practice question we did. Didn't we say that risk involves potential damage from an exploit on a vulnerability?

Splunk SPLK-3003 Exam - Topic 6 Question 10 Discussion