Splunk · Free Practice Questions · Last reviewed May 2026
36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?
The scores are additive.
The 'sum' aggregation logic aggregates individual event scores into a total score.
Only the highest score is kept.
The scores are averaged.
The risk score is reset to zero.
A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?
Correlation Search Editor
The risk score for a specific rule is typically defined within the 'Risk Analysis' adaptive response action settings in the correlation search.
Identity Manager
Risk Index Configuration
Risk Notable Settings
During an investigation, you need to group related notables into a single investigation container. Which feature should you use?
Splunk Case Management
Case Management allows analysts to create cases and add relevant notable events to them.
Notable Event Aggregation
Notable Event Suppression
Incident Review Filters
You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?
correlation_search.log
splunkd.log
splunkd.log contains logs for adaptive response executions and scheduling errors.
notable_events.log
risk_index.log
A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?
Risk Index Retention Policy
Data Model Acceleration
Asset and Identity Table
Correlation Search Suppression
Notable Event Suppression allows analysts to define criteria to ignore specific events that should not trigger a notable.
When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?
Threat Activity Dashboard
Access Anomalies Dashboard
Incident Review
Risk Analysis Dashboard
This dashboard displays the breakdown of risk scores by object and contributing events.
Want more Investigation And Risk Management practice?
Practice this domainYou are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?
The indexer cluster master status.
Connectivity and credentials in the specific Add-on configuration.
Adaptive Response relies on correctly configured Add-ons and connectivity.
The number of active users in Splunk.
The notable event retention policy.
Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?
Asset and Identity Investigation.
Notable Event Suppression.
Risk Analysis Dashboard.
Incident Review.
Incident Review is the primary console for managing event status.
When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?
Disable and re-enable the Enterprise Security app.
Use the CIM Validator app to check compliance against the data model.
The CIM Validator is the standard tool for verifying mapping compliance.
Change the sourcetype to 'cisco_asa' manually.
Re-index all firewall logs from the past 30 days.
Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?
The local/inputs.conf file.
Splunk ES > Configure > Data Enrichment.
Settings > CIM Setup.
CIM Setup is the dedicated interface for managing add-on mappings.
Settings > Data Model acceleration.
You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?
Assign the owner via a post-process lookup file.
Use the 'owner' field in the notable event action configuration to map to an extracted user field.
Mapping the owner field to an extraction ensures dynamic assignment.
Create separate correlation searches for each user.
Hardcode the owner name in the correlation search action.
When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?
It automatically blocks the user from the network.
It increases the search performance.
It deletes the original notable event.
It allows the system to aggregate disparate alerts onto a single entity.
Risk analysis helps in detecting patterns across different alert types.
Want more SIEM Defenses And Data Practices practice?
Practice this domainYou are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?
Notable Event Aggregation
Asset Investigator
Threat Activity
Risk Analysis
Risk Analysis aggregates risk events for entities, which is perfect for long-term insider threat tracking.
A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?
User Activity Center
Protocol Intelligence
Access Anomalies
This dashboard specifically aggregates authentication data to highlight brute-force patterns.
Threat Intelligence Activity
A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?
Incident Review
Audit Trails
Content Management
Threat Intelligence
Threat Intel provides the framework to match incoming traffic against known malicious phishing URLs.
You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?
Notable Event Suppressor
Identity Table
Asset Table
Threat Intelligence Framework
The framework allows you to ingest lists of known malicious IPs and match them against logs.
An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?
file_hash
The file_hash field allows for immediate investigation into file reputation.
src_user
signature
dest_port
You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?
Network Traffic
Change Analysis
The Change Analysis data model is designed to capture configuration and system policy changes.
Endpoint
Authentication
Want more Threat And Attack Types practice?
Practice this domainYou are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?
search dest_ip=x.x.x.x | rare dest_ip
search dest_ip=x.x.x.x | streamstats current=f window=2 global=f last(_time) as prev_time | eval diff=_time - prev_time
Calculating the time difference between consecutive events is the standard method for finding periodic beaconing.
search dest_ip=x.x.x.x | timechart span=1h count
search dest_ip=x.x.x.x | stats count by _time
You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?
index=windows EventCode=4697 | table User, ServiceName
index=windows EventCode=4688 | stats count by ParentProcessName, ProcessName
This efficiently isolates process lineage to spot anomalous spawns from wmiprvse.exe.
index=windows EventCode=4624 | table Logon_Type, User
index=windows EventCode=7045 | stats count by ServiceName
You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?
EventCode 1
EventCode 11
EventCode 10
Event ID 10 is specifically designed for process access monitoring.
EventCode 3
You are analyzing a data model using tstats. You need to identify rare process executions across your environment. Which command structure provides the most performance-optimized result?
| tstats summariesonly=t count from datamodel=Endpoint.Processes by Processes.process_name | sort count
This is the most efficient method using pre-calculated data models.
| inputlookup processes.csv | stats count
index=windows | rare limit=20 ProcessName
| search index=windows | stats count by ProcessName | sort -count
When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?
Threat Intelligence Source List
Hunt Procedure and Query Logic
Clear steps and query logic ensure the hunt can be audited and repeated.
Executive Summary
Hardware Requirements
Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?
Saved Search
Data Model Acceleration
Search Macro
Macros allow for reusable, parameterizable SPL blocks.
Event Type
Want more Threat Hunting practice?
Practice this domainWhich phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?
Installation.
Command and Control (C2).
C2 requires outbound communication to an attacker-controlled server.
Reconnaissance.
Exploitation.
You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?
search sourcetype=sysmon | rename command as powershell.
| inputlookup mitre_tactics | where process=powershell.
index=main | lookup mitre_attack_id.
tstats count from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe.
This is the most efficient way to query endpoint process data for specific commands.
An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?
Domain Controller authentication logs.
Email gateway logs and web proxy logs.
These are the primary sources for detecting the delivery of malicious content.
Internal host process creation logs.
Endpoint file integrity monitoring.
You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?
Navigate to the 'Compliance' tab and run a report on 'Framework Coverage'.
This tab maps installed detections against NIST CSF and shows maturity scores.
Manually edit the 'Data Model' accelerations for NIST compliance.
Modify the 'Notable Event' aggregation policy to NIST standards.
Update the 'Threat Intelligence' index settings to include NIST tags.
Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?
Vulnerability Data Model.
Assets and Identity Data Model.
This model is specifically designed to store and correlate asset inventory information.
Endpoint Data Model.
Network Traffic Data Model.
You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?
Splunk Add-on for Linux Auditd.
Splunk App for Infrastructure (SAI).
Splunk App for CIS Benchmarks.
This app provides out-of-the-box dashboards for CIS compliance.
Splunk Enterprise Security Vulnerability Scanner.
Want more Cyber Landscape And Industry Frameworks practice?
Practice this domainWhich command is used to visualize data in a time-series chart?
graph count _time
stats count over time
timechart count by sourcetype
Timechart is the standard command for aggregation over time.
chart count by _time
Which command would you use to filter out events where the 'status' field is 200?
eval status!=200
where status=200
drop status=200
search status!=200
This is the most direct way to exclude events with status 200.
Which command is used to rename a field in the results table for better readability?
table src_ip as "Source Address"
fields src_ip:"Source Address"
eval "Source Address" = src_ip
rename src_ip as "Source Address"
The rename command follows the syntax: rename <field> as <new_name>.
You need to calculate the average time delta between 'login' and 'logout' events for each user. Which command approach is most effective?
index=auth | transaction user_id | stats avg(duration) by user_id
The transaction command automatically calculates a 'duration' field for grouped events.
index=auth | delta _time as time_diff by user_id
index=auth | stats min(_time) as start, max(_time) as end by user_id | eval delta=end-start
index=auth | eval time_diff = logout_time - login_time
You need to append the contents of a lookup file 'threat_intel.csv' to your search results based on the field 'src_ip'. Which command is correct?
index=firewall | enrich src_ip threat_intel.csv
index=firewall | lookup threat_intel.csv src_ip OUTPUTNEW severity, threat_type
The lookup command adds fields from the CSV to existing events based on a common field.
index=firewall | join src_ip [inputlookup threat_intel.csv]
index=firewall | inputlookup threat_intel.csv src_ip
index=firewall | append threat_intel.csv
You are investigating a potential data exfiltration event. You have a lookup file called 'authorized_servers.csv' containing a field 'ip_address'. You want to find all connections to IPs not in this list. Which command fulfills this?
index=network | lookup authorized_servers.csv ip_address AS dest_ip OUTPUT ip_address as is_authorized | where is_authorized=""
Using a lookup to output a field and checking for nulls is a standard way to find non-matches.
index=network | inputlookup authorized_servers.csv | where dest_ip!=ip_address
index=network | lookup authorized_servers.csv dest_ip | where isnull(dest_ip)
index=network | filter dest_ip NOT IN authorized_servers.csv
Want more SPL Search Proficiency practice?
Practice this domainThe SPLK-5001 exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Investigation And Risk Management, SIEM Defenses And Data Practices, Threat And Attack Types, Threat Hunting, Cyber Landscape And Industry Frameworks, SPL Search Proficiency. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Splunk SPLK-5001 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.