SPLK-1004 Practice Test 11 — 15 Questions

Question 1

Which CIM data model should be used to normalize authentication data?

Accepted Answer

Authentication. The Authentication data model in the Common Information Model (CIM) is specifically designed to normalize authentication data, including successful and failed logins, account changes, and privilege escalations. It provides a standardized set of fields and tags for authentication events across different sources.

Answer

Change Analysis

Answer

Network Traffic

Answer

Email

Question 2

You are building a dashboard with a text input that sets a token named `filter_field`. You want the token to be available to all panels and to have a default value of `status`. Which XML element and attribute should you use to define this input?

Accepted Answer

status. In Simple XML, the element sets the default value for an input token. For a text input, placing status inside the element ensures the token filter_field starts with status when the dashboard loads. This makes the default available to all panels using that token.

Answer

<input type="text" token="filter_field"><label>status</label></input>

Answer

<input type="text" token="filter_field"><default>status</default></input>

Answer

Question 3

When configuring a CIM-compliant data model, what happens if a field is tagged but the event type is not associated with the model?

Accepted Answer

The data will not appear in the data model. For an event to be included in a CIM-compliant data model, it must be matched by an event type that is explicitly associated with the data model's root or child objects. Tagging a field alone does not create that association; the event type must be added to the data model's constraints. Without the event type linkage, the events are simply not selected by the data model's search, so they will not appear in the model.

Answer

The model will use default values

Answer

The model will trigger a warning

Answer

The search will automatically include all indexed events

Question 4

A user is creating a Pivot report and notices that a field they expected to see is not available in the Pivot interface. The field exists in the raw events and is extracted by a regex-based field extraction. The data model object for the relevant dataset does not include this field. What is the most likely reason?

Accepted Answer

The field is not defined as a field in the data model object, so it is not exposed to Pivot.. Pivot displays only the fields that are explicitly defined in the data model object. If a field is extracted from raw events but not added to the data model, it will not appear in Pivot. Users must add the field to the data model to make it available for Pivot reporting.

Answer

The field extraction is not enabled for the data model's acceleration.

Answer

The field extraction uses a regex that is not compatible with the data model acceleration process.

Answer

The user does not have permission to view that field in Pivot.

Question 5

You maintain a KV Store lookup named asset_inventory in the search app. A scheduled search populates it every 15 minutes. A dashboard user reports that when they run a search that joins against asset_inventory, some events return no lookup fields, even though the assets exist in the collection. You confirm the lookup definition is shared globally and the collection contains the expected keys. Which action should you take to ensure the lookup is usable by the dashboard user's searches without granting them write access to the collection?

Accepted Answer

Edit the lookup definition and set the permissions to share it with the appropriate role while ensuring the KV Store collection ACL allows read for that role.. KV Store lookups are backed by collections with their own access controls. Even if the lookup definition is globally shared, the user still needs read access to the collection. Setting the lookup definition's permissions and the collection ACL to allow read for the user's role resolves the missing fields while keeping write access restricted to the scheduled job, which is the correct least-privilege solution.

Answer

Add the dashboard user to the role that owns the scheduled search and restart the search head.

Answer

Grant the dashboard user the admin role so they inherit KV Store write permissions.

Answer

Convert the KV Store lookup to a CSV lookup and upload the file to the search app.

Question 6

You have an alert that runs a search every 15 minutes and triggers when the number of failed login attempts exceeds 10. The alert is configured to send an email. After a week, you notice that the alert triggered multiple times but no emails were received. You verify the search returns results and the email settings are correct. What is the most likely cause?

Accepted Answer

The alert is configured to throttle by a field, and the throttle period suppresses subsequent emails.. Alert throttling suppresses alert actions for a defined period. If throttling is enabled, even though the alert triggers, the action (email) may be suppressed if the throttle condition is met. The other options would either prevent the alert from triggering or are less likely given the scenario. Throttling is a frequent configuration oversight that leads to missing notifications.

Answer

The alert action's 'Expires' setting is set to a past date, disabling the action.

Answer

The alert is configured with a 'Number of Results' trigger condition instead of a custom condition.

Answer

The alert's time range is set to 'All time', causing it to search too much data and time out.

Question 7

You have a lookup definition named `employee_lookup` that maps `employee_id` to `department` and `manager`. You want to use this lookup in a search to add the `department` and `manager` fields to your events, but you also want to ensure that if the `department` field already exists in the event, it is not overwritten. Which `lookup` command syntax achieves this?

Accepted Answer

`| lookup employee_lookup employee_id OUTPUTNEW department, manager`. `OUTPUTNEW` adds fields from the lookup only if they do not already exist in the event. If the `department` or `manager` fields are already present, they remain unchanged. This is the correct way to enrich events without overwriting existing field values. `OUTPUT` would overwrite existing fields, and there is no `OVERWRITE` argument in the `lookup` command. Using aliases with `OUTPUT` does not preserve the original fields under their original names.

Answer

`| lookup employee_lookup employee_id OUTPUT department AS new_department, manager AS new_manager`

Answer

`| lookup employee_lookup employee_id OUTPUT department, manager`

Answer

`| lookup employee_lookup employee_id OUTPUT department, manager OVERWRITE=false`

Question 8

You are building a dashboard panel that must display the top 10 source IP addresses by count of failed logins, and the results must be returned as a single results set with a field named 'fail_count'. You also need to add a drilldown that passes the selected source IP to another dashboard. Which search command sequence correctly produces the required results set while keeping the field name 'fail_count'?

Accepted Answer

index=security action=failure | stats count as fail_count by src_ip | sort - fail_count | head 10. To display the top 10 source IPs by failed login count with a specific field name, aggregate with stats using 'count as fail_count by src_ip', then sort descending and limit with head 10. This yields a single results set with one row per source IP and the exact field name needed for the drilldown token.

Answer

index=security action=failure | top limit=10 src_ip | rename count as fail_count

Answer

index=security action=failure | eventstats count as fail_count by src_ip | dedup src_ip | sort - fail_count

Answer

index=security action=failure | stats count by src_ip | where count > 10 | sort - count

Question 9

You have a CSV lookup file 'employees.csv' with fields employee_id, department, and manager. You need to enrich incoming events that contain 'user' by matching user to employee_id and adding department and manager to the events. The lookup should apply automatically to all searches against the 'main' index without requiring users to add a lookup command. What should you configure?

Accepted Answer

Create a lookup definition and then create an automatic lookup that maps user to employee_id and outputs department and manager for the main index.. Automatic lookups are designed to enrich events at search time without requiring the lookup command. By creating a lookup definition for the CSV and then an automatic lookup that matches user to employee_id and outputs department and manager, scoped to the main index, all searches against that index receive the enriched fields.

Answer

Define a field alias that maps user to employee_id and then use the lookup command in each search.

Answer

Upload the CSV as a lookup table file and enable the 'Global' permission so it applies to all searches automatically.

Answer

Create a calculated field that uses the lookup() function to return department and manager for each event.

Question 10

A Splunk power user is troubleshooting a search that uses a calculated field named 'response_time' defined as 'duration_ms / 1000'. The field 'duration_ms' is extracted from raw events, but the calculated field returns null values for some events. Upon investigation, the user finds that 'duration_ms' is sometimes missing or contains non-numeric characters. Which of the following is the most likely reason for the null values in 'response_time'?

Accepted Answer

The eval expression fails to handle non-numeric or missing values, resulting in null for those events.. Calculated fields use eval expressions that return null when operations encounter non-numeric or missing values. Since 'duration_ms' sometimes lacks numeric content, the division yields null. The correct approach is to use functions like tonumber() or coalesce() to handle such cases, ensuring a numeric result or a default value.

Answer

The field 'duration_ms' is not indexed, so it is not available for calculated fields.

Answer

The calculated field expression is evaluated before field extraction, so 'duration_ms' is not yet available.

Answer

The calculated field is defined with the wrong data type, causing Splunk to discard invalid results.

Question 11

You are configuring a new alert in Splunk Enterprise Security. You want to ensure that the alert triggers only when a specific condition is met and that it performs multiple actions. Which two alert settings are required to define the alert's trigger condition and actions? (Choose two.)

Accepted Answer

Alert actions (e.g., email, webhook, script). To define when an alert triggers, you must configure a trigger condition, which can be based on the number of results or a custom condition. To define what the alert does when it triggers, you must configure alert actions, such as sending an email or executing a script. These two settings are essential for the alert's core functionality. Other settings like alert type, permissions, and schedule are important but do not directly define the trigger condition and actions.

Answer

Alert type (e.g., Scheduled, Real-time)

Answer

Alert schedule (e.g., cron expression)

Answer

Alert permissions (e.g., sharing with other users)

Question 12

A security team wants every event that contains the string 'Failed password' to be automatically tagged as 'brute_force' so that analysts can later run a simple tag-based search without typing the full string each time. The tag should appear on matching events as soon as the search runs, with no index-time processing. Which of the following is the correct way to implement this?

Accepted Answer

Define an event type in eventtypes.conf whose search matches 'Failed password', then add the tag 'brute_force' to that event type so matching events receive the tag at search time.. Event types are search-time knowledge objects, and tags are applied by associating them with an event type. When a search evaluates the event type's search string, every matching event inherits the tag, so analysts can retrieve those events with tag=brute_force. This requires no index-time processing or reindexing, and the tag becomes visible as soon as the event type and tag configuration are saved and knowledge objects are refreshed.

Answer

Create a saved search that runs every five minutes and writes the tag into a lookup file, then use the lookup command in each analyst search.

Answer

Add a TRANSFORMS stanza in props.conf that runs a regex at index time and assigns the tag to the event's metadata.

Answer

Create a field alias in props.conf that maps a new field named 'brute_force' to the raw event text so that tag=brute_force resolves.

Question 13

A security analyst needs to enrich raw firewall logs by attaching the matching department name from a lookup table. The lookup table contains department IDs, and the firewall logs contain a field called dept_id. The analyst wants to add the department name to each event without discarding events that have no matching department ID. Which command should be used?

Accepted Answer

lookup. The lookup command is specifically designed to enrich events with fields from an external lookup table. It matches on a field such as dept_id and adds the corresponding department name. By default, it retains events with no match, which aligns with the requirement to not discard unmatched events.

Answer

append

Answer

join

Answer

transaction

Question 14

An analyst is reviewing web server logs and needs to display the top 5 URL paths by total bytes transferred. The field 'bytes' is numeric, and 'uri_path' is a string. Which search produces the correct result with the least performance impact?

Accepted Answer

index=web | stats sum(bytes) as total_bytes by uri_path | sort - total_bytes | head 5. To find the top 5 URL paths by total bytes transferred, you need to sum the numeric bytes field for each uri_path and then sort descending. The stats command efficiently groups by uri_path and calculates the sum, producing a compact result set. Sorting and limiting with head gives the top 5. This approach minimizes memory and processing compared to eventstats or chart, which retain more data or add overhead.

Answer

index=web | eventstats sum(bytes) as total_bytes by uri_path | dedup uri_path | sort - total_bytes | head 5

Answer

index=web | top limit=5 bytes by uri_path

Answer

index=web | chart sum(bytes) over uri_path | sort - sum(bytes) | head 5

Question 15

A dashboard panel runs a search that returns 10,000 events, but the panel only displays a single-value element showing the event count. Users report the dashboard is sluggish. Which Splunk search command should you add to the base search to reduce the data returned to the panel while preserving the count?

Accepted Answer

stats count. The panel only needs the total number of matching events, so applying a transforming command that collapses the result set to a single row is the correct optimization. Aggregating with stats count returns one value, which is exactly what the single-value panel requires, and it eliminates the overhead of transferring and rendering thousands of raw events.

Answer

table _time, host

Answer

sort -_time

Answer

dedup host