Splunk
SPLK-5001 · Question #23
SPLK-5001 Question #23: Real Exam Question with Answer & Explanation
The correct answer is D. src_ip. See the full explanation below for the reasoning.
Question
An analyst is investigating a network alert for suspected lateral movement from one Windows host to another Windows host. According to Splunk CIM documentation, the IP address of the host from which the attacker is moving would be in which field?
Options
- Ahost
- Bdest
- Csrc_nt_host
- Dsrc_ip
Community Discussion
No community discussion yet for this question.