Splunk
SPLK-5001 · Question #49
SPLK-5001 Question #49: Real Exam Question with Answer & Explanation
The correct answer is D. Other, since a security engineer needs to ingest the required logs.. See the full explanation below for the reasoning.
Question
An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the alert are not available. What event disposition should the analyst assign to the Notable Event?
Options
- ABenign Positive, since there was no evidence that the event actually occurred.
- BFalse Negative, since there are no logs to prove the activity actually occurred.
- CTrue Positive, since there are no logs to prove that the event did not occur.
- DOther, since a security engineer needs to ingest the required logs.
Community Discussion
No community discussion yet for this question.