The correct answer remains Splunk Security Essentials App . Although the answer choices have been reordered, the technical requirement is unchanged: the engineer needs an application that facilitates use-case development by cross-referencing security detections with MITRE ATT & CK .
Splunk Security Essentials is particularly suited to this process because it provides curated security content and ATT & CK-oriented views that help engineers understand which detections correspond to specific adversary techniques. This enables a threat-informed program to evaluate existing coverage, identify gaps, understand data prerequisites, and prioritize detection development according to realistic adversary behaviors.
The supplied course material also uses Splunk Security Essentials in the context of ATT & CK-based analysis, including industry-oriented technique visualization, which is consistent with this function.
By contrast, Enterprise Security is the primary operational SIEM and detection platform, while the Enterprise Security Content Update App is used to distribute and update Splunk security content. The supporting-add-on option does not represent the principal ATT & CK-driven use-case development experience being tested.
Study Guide topics: Splunk Security Essentials, MITRE ATT & CK, threat-informed defense, use-case development, detection coverage assessment, security-content mapping.
