MENU
An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which the attacker is moving would be in which field?
Suggested Answer: D
Get Premium SPLK-5001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
29 comments · newest first
LU
Luis
10 months ago
I agree, src_ip makes the most sense here.
JU
Julieta
11 months ago
I'm surprised it's not in dest. That seems logical.
AL
Alease
11 months ago
No way, it's the host field for sure!
NA
Nakita
11 months ago
I thought it would be in src_nt_host.
AR
Arlie
11 months ago
It's definitely in the src_ip field.
DA
Dawne
12 months ago
I’m a bit confused; I thought dest was for the destination host, but I can see how src_nt_host could fit in this context as well.
MA
Maricela
12 months ago
I feel like the host field is more about the destination, so I'm leaning towards src_ip for the source IP address.
MA
Mauricio
12 months ago
I remember practicing a question similar to this, and I believe the src_nt_host field might be relevant too, but it could be tricky.
BU
Burma
1 year ago
I think the IP address of the host from which the attacker is moving should be in the src_ip field, but I'm not entirely sure.
SH
Shannon
1 year ago
This is a tricky one. I'm not super familiar with the Splunk CIM, so I'm not sure which field would contain the attacker's IP address. I'll have to guess and hope for the best on this one.
MA
Marshall
1 year ago
Okay, let me think this through. The question is asking about lateral movement, so the IP address we're looking for would be the source IP, not the destination. I'm pretty confident the answer is C. src_nt_host.
CA
Cassie
1 year ago
Hmm, I'm a bit unsure about this one. I know the Splunk CIM documentation is important, but I can't quite remember the specific field names off the top of my head. I'll need to review the documentation carefully before answering.
CA
Cathern
1 year ago
This seems straightforward. The question is asking about the field that would contain the IP address of the host from which the attacker is moving, so I think the answer is D. src_ip.
CO
Coral
1 year ago
I bet the answer is 'E) All of the above' because security is just a giant game of 'Guess the field'.
LI
Lilli
1 year ago
This question is a real brain-teaser. I'm just going to close my eyes and pick one at random. What could go wrong?
GE
Gerald
1 year ago
B) dest, of course! The attacker is moving to the destination host, so that's where the IP address would be.
FR
Frederica
1 year ago
C) src_nt_host
AN
Angelo
1 year ago
B) dest
RI
Richelle
1 year ago
A) host
LA
Lavina
1 year ago
I'm going with C) src_nt_host. It just makes sense that the Windows host the attacker is coming from would be in that field.
AN
Annamae
1 year ago
I'm not sure, but I think it might be A) host. That field could also contain the information we need.
GE
German
1 year ago
I agree with you, I also believe it's D) src_ip. It's a common field for source IP addresses.
HA
Hannah
1 year ago
I think it's D) src_ip. That field usually contains the IP address of the source.
GA
Gayla
2 years ago
Actually, according to Splunk CIM documentation, the IP address of the host from which the attacker is moving would be in the src_nt_host field.
FR
Franchesca
2 years ago
The src_ip field seems like the obvious choice here. I mean, that's where the attacker's IP address would be, right?
GL
Glory
1 year ago
I think it's src_nt_host. That field is specifically for the network host where the attack originated.
NA
Na
1 year ago
Yes, you're correct. The src_ip field would contain the IP address of the host from which the attacker is moving.
DO
Donette
2 years ago
I believe it should be in the dest field.
GA
Gayla
2 years ago
I think the IP address of the host would be in the src_ip field.