What kind of value is in the red box in this picture?

Question

Exhibit

Options

• AA risk score.
• BA source ranking.
• CAn event priority.
• DAn IP address rating.

• A
  89% (17)
• B
  5% (1)
• C
  5% (1)

Explanation

Option A is correct because risk scores are numerical values assigned to entities (users, devices, IP addresses) to quantify their overall threat level based on aggregated security events - this is a core concept in SIEM platforms like Splunk ES, where risk-based alerting (RBA) surfaces these scores prominently in dashboards.

Why the distractors are wrong:

• B (Source ranking): Source ranking refers to credibility or priority of a data feed/log source, not a value tied to an entity's threat level.
• C (Event priority): Event priority classifies the urgency of a single alert or log entry; a risk score aggregates across multiple events over time.
• D (IP address rating): IP reputation ratings exist (e.g., threat intel feeds), but the value shown is an entity-level risk score, not an external reputation lookup specific to an IP.

Memory tip: Think Risk = Running total - a risk score accumulates across events, whereas the distractors all describe single-point-in-time classifications. If the value reflects "how dangerous is this entity overall?", it's a risk score.

No community discussion yet for this question.