Practice · Splunk Certified Cybersecurity Defense Architect

~/splunk-splunk-certified-cybersecurity-defense-architect · splunk-splunk-certified-cybersecurity-defense-architect_d1_570739b0fd9a ▊

← Splunk Certified Cybersecurity Defense Architect · practice sheet

splunk-splunk-certified-cybersecurity-defense-architect_d1_570739b0fd9a domain/d1 · medium single

During incident triage in the Incident Review interface of Splunk Enterprise Security, which enhancement allows the SOC to quickly prioritize critical incidents without re-running the Incident Response search or refreshing the page?

A Auto refresh combined with an interactive timeline for notable events
B Risk score decay applied to aging notable events
C Federated search across external threat feeds
D Automated SOAR playbook execution on every notable event

Unlock this exam to join the per-question discussion and vote on questions.

next question →