Discuss Splunk SPLK-5001 Exam Topic 8 Question 30

While investigating findings in Enterprise Security, an analyst has identified a compromised device. Without leaving ES, what action could they take to run a sequence of containment activities on the compromised device that also updates the original finding?

ARun an event-level workflow action that initiates a SOAR playbook.

BRun a field-level workflow action that initiates a SOAR playbook.

CRun an adaptive response action that initiates a SOAR playbook.

DRun an alert action that initiates a SOAR playbook.

Suggested Answer: C

Get Premium SPLK-5001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

30 comments · newest first

Anisha 6 months ago

C could be effective too. It adapts to the situation well.

Helene 6 months ago

A is solid. It allows for a structured response to the incident.

Destiny 6 months ago

D sounds good, but I prefer actions that are more comprehensive.

Pauline 7 months ago

Option B feels too limited. Field-level actions don’t cover everything.

Barney 7 months ago

I’m leaning towards C. Adaptive response seems more flexible.

Brice 7 months ago

I think option A is the best choice. It targets the event level directly.

Zona 8 months ago

D) just seems like a workaround, not a solid solution.

Kiera 8 months ago

Wait, can you really do all that without leaving ES?

Malissa 8 months ago

C) sounds right, adaptive responses are key!

Jeffrey 8 months ago

I'd go with C) Run an adaptive response action. It's like a superhero cape for your security team - they can swoop in and save the day without ever leaving their desk!

Tiera 8 months ago

B) Run a field-level workflow action that initiates a SOAR playbook. Hmm, I'm not sure about this one. Seems a bit too specific compared to the other options.

Kaycee 8 months ago

D) Run an alert action that initiates a SOAR playbook. Alerts are designed for these types of situations, so this seems like the logical choice.

Jacquelyne 9 months ago

A) Run an event-level workflow action that initiates a SOAR playbook. This would be my choice as it allows the analyst to take action directly from the event details.

Freeman 9 months ago

C) Run an adaptive response action that initiates a SOAR playbook. This seems like the most appropriate option to contain the compromised device without leaving the Enterprise Security platform.

Jules 9 months ago

I’m torn between A and C. I know SOAR playbooks are important, but I can't recall the exact differences between those workflow actions.

Celestina 9 months ago

I feel like D could be a good option since it mentions alerts, but I’m not clear on how that ties into containment activities.

Mickie 9 months ago

I remember practicing a similar question where we discussed adaptive responses, so I’m leaning towards C, but I’m not confident.

Nieves 9 months ago

I think the answer might be A, but I'm not entirely sure if it specifically mentions event-level actions in the context of containment.

Selene 10 months ago

I disagree, B) seems more efficient for field-level actions.

Dominga 10 months ago

I'm pretty confident that C is the correct answer. Running an adaptive response action to initiate a SOAR playbook seems like the most straightforward way to handle this situation without leaving Enterprise Security.

Margarett 10 months ago

Okay, I've got this. The key is to take an action that initiates a SOAR playbook, so I'd say C is the way to go. Adaptive response sounds like the right approach to contain the compromised device.

Nichelle 10 months ago

A) is the best choice for containment.

Francoise 10 months ago

I'm leaning towards B. A field-level workflow action might give me more control over the specific actions taken on the compromised device, but I'll need to double-check the details.

Dorothy 11 months ago

Hmm, I'm a bit confused. What's the difference between a field-level workflow action and an event-level workflow action? I'm not sure which one to choose.

Camellia 11 months ago

I think I'd go with option C. Running an adaptive response action seems like the best way to initiate a SOAR playbook without leaving Enterprise Security.

Keneth 5 months ago

↳ replying to Camellia

C is definitely the way to go for quick containment!

Truman 5 months ago

↳ replying to Camellia

I think D is overlooked. It might be useful in some cases.

Cortney 6 months ago

↳ replying to Camellia

Option B could work too, but I like C better.

Olive 6 months ago

↳ replying to Camellia

I was leaning towards option A. Event-level seems strong.

Makeda 6 months ago

↳ replying to Camellia

I agree, option C makes sense. It's efficient.

Splunk SPLK-5001 Exam - Topic 8 Question 30 Discussion