ExamTopics Logo
Mail Us[email protected]
Menu
Splunk Discussions
exam questions

Exam SPLK-5001 All Questions

View all questions & answers for the SPLK-5001 exam
Go to Exam

Exam SPLK-5001 topic 1 question 64 discussion

Actual exam question from Splunk's SPLK-5001
Question #: 64
Topic #: 1
[All SPLK-5001 Questions]

An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the alert are not available.
What event disposition should the analyst assign to the Notable Event?

  • A. Benign Positive, since there was no evidence that the event actually occurred.
  • B. False Negative, since there are no logs to prove the activity actually occurred.
  • C. True Positive, since there are no logs to prove that the event did not occur.
  • D. Other, since a security engineer needs to ingest the required logs.
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by nosavotor at Sept. 26, 2024, 9:13 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
nosavotor
2 months, 3 weeks ago
Could someone please verify the accuracy of this answer
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago