Splunk · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?
The indexer cluster master status.
Connectivity and credentials in the specific Add-on configuration.
Adaptive Response actions execute through the specific add-on managing that device, so its configuration supplies the connectivity and credentials used for remote execution. Checking these first satisfies the stem's requirement to verify the action's own transport and authentication path before investigating broader platform or network issues.
The number of active users in Splunk.
The notable event retention policy.
Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?
Asset and Identity Investigation.
Notable Event Suppression.
Risk Analysis Dashboard.
Incident Review.
Incident Review provides the central console where analysts triage notable events, changing status, owner, urgency and disposition. This workflow directly manages each notable's lifecycle from detection through assignment to closure, satisfying the requirement to govern event handling.
When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?
Disable and re-enable the Enterprise Security app.
Use the CIM Validator app to check compliance against the data model.
The CIM Validator app inspects indexed events against a selected data model and reports which fields fail to map, exposing missing or misnamed CIM fields. This satisfies the stem's efficiency requirement by diagnosing mapping gaps before any manual field extraction work.
Change the sourcetype to 'cisco_asa' manually.
Re-index all firewall logs from the past 30 days.
You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?
Assign the owner via a post-process lookup file.
Use the 'owner' field in the notable event action configuration to map to an extracted user field.
Mapping the notable event's owner field to an extracted user field assigns each event to the relevant user, so distinct users triggering the same correlation search retain correct ownership instead of a single static value.
Create separate correlation searches for each user.
Hardcode the owner name in the correlation search action.
When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?
It automatically blocks the user from the network.
It increases the search performance.
It deletes the original notable event.
It allows the system to aggregate disparate alerts onto a single entity.
A Risk Object normalises alerts from different correlation searches onto one entity, such as a user or host, so Splunk ES aggregates their risk scores. This lets analysts see cumulative risk per entity rather than isolated alerts, which is the framework's core purpose.
A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?
Set the TZ attribute in props.conf for the specific sourcetype.
Setting the TZ attribute in props.conf for the affected sourcetype corrects timestamp interpretation at index time, aligning source data with Splunk's expected time zone. This resolves the mismatch preventing correlation searches from generating notable events.
Modify the data model acceleration schedule.
Use an eval statement in the search to subtract hours.
Change the Splunk server time zone.
Want more SIEM Defenses And Data Practices practice?
Practice this domainWhen calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?
The scores are additive.
With sum aggregation, each qualifying risk event contributes its own score, and the total for an object within the window is the arithmetic total of those individual event scores. This additive behaviour is precisely what the 'sum' method specifies, so overlapping events accumulate rather than being averaged or deduplicated.
Only the highest score is kept.
The scores are averaged.
The risk score is reset to zero.
A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?
Correlation Search Editor
Risk rule weighting is configured within the Correlation Search Editor, where the risk object and its score are defined. Adjusting the weight here changes how much each triggered correlation search contributes to an entity's overall risk score, satisfying the requirement to modify a specific rule's weight.
Identity Manager
Risk Index Configuration
Risk Notable Settings
During an investigation, you need to group related notables into a single investigation container. Which feature should you use?
Splunk Case Management
Splunk Case Management groups related notables, events and artefacts into a single investigation container, preserving shared context, ownership and status. This directly satisfies the need to consolidate related notables, which standalone correlation searches or dashboards cannot do.
Notable Event Aggregation
Notable Event Suppression
Incident Review Filters
A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?
Risk Index Retention Policy
Data Model Acceleration
Asset and Identity Table
Correlation Search Suppression
Correlation Search Suppression lets you define a suppression rule directly on the Risk Notable correlation search, filtering out low-fidelity risk events before they generate notables. Editing the search itself or downstream risk rules would not cleanly exclude those events at source.
When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?
Threat Activity Dashboard
Access Anomalies Dashboard
Incident Review
Risk Analysis Dashboard
The Risk Analysis Dashboard visualises risk contributors per user, satisfying the stem's requirement for a user-specific view of contributing risk factors. It aggregates risk events by risk object, showing which detections and sources drive a user's score, unlike the Incident Review or Risk Notables views.
In the context of Splunk ES, what is an 'Asset'?
A malicious IP address.
An entity like a host or server.
An Asset in Splunk Enterprise Security is a modelled entity representing a host, server or similar device, populated from asset lookup data and used to enrich notable events. This satisfies the definition by identifying the host or server as the entity being described.
A saved search report.
A notable event.
Want more Investigation And Risk Management practice?
Practice this domainYou are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?
Notable Event Aggregation
Asset Investigator
Threat Activity
Risk Analysis
Risk Analysis aggregates risk attributed to entities such as users and systems, letting you correlate many disparate events across extended timeframes into a cumulative risk score. That long-duration, entity-centric correlation is exactly what the insider-threat exfiltration scenario requires.
A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?
User Activity Center
Protocol Intelligence
Access Anomalies
Access Anomalies correlates authentication failures with subsequent successful logins, directly surfacing the failed-then-successful pattern from a new source IP that the stem describes. It aggregates this behaviour per user and src, letting the analyst confirm brute-force activity without manual search construction.
Threat Intelligence Activity
You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?
Notable Event Suppressor
Identity Table
Asset Table
Threat Intelligence Framework
The Threat Intelligence Framework ingests external threat feeds and matches indicators such as IP addresses against indexed events, letting you confirm whether the address appears in a TOR exit-node intelligence source. This directly satisfies the requirement to verify an external IP against known malicious TOR exit-node data.
An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?
file_hash
The `file_hash` field carries the cryptographic digest of the attachment, which is the primary pivot key the 'File' domain dashboard queries against. It satisfies the stem's requirement for pivoting to file-centric investigation, since Splunk ES correlates hashes across endpoints and sandboxes to reveal execution, prevalence and verdict data.
src_user
signature
dest_port
You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?
Network Traffic
Change Analysis
Change Analysis tracks modifications to system configuration and policy objects, including audit policy changes made via auditpol.exe. Its Change data model captures the object affected, the action taken and the user responsible, satisfying the stem's requirement to locate audit-policy modification events within Splunk's Common Information Model.
Endpoint
Authentication
A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?
Brute Force Access
Malware Detection
Lateral Movement
Port 445 indicates SMB, a common lateral-movement channel; the Lateral Movement correlation search aggregates authentication and file-share activity across hosts to surface exactly that behaviour, satisfying the requirement to prioritise a search for suspected spread from the infected host.
DGA Detection
Want more Threat And Attack Types practice?
Practice this domainYou are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?
index=windows EventCode=4697 | table User, ServiceName
index=windows EventCode=4688 | stats count by ParentProcessName, ProcessName
Aggregating EventCode 4688 by parent and child process directly surfaces wmiprvse.exe spawning shells such as cmd.exe or powershell.exe, satisfying the hunt's requirement to identify anomalous WMI process creation. The stats count by pair ranks frequency, letting you spot rare or unexpected parent-child combinations indicative of lateral movement.
index=windows EventCode=4624 | table Logon_Type, User
index=windows EventCode=7045 | stats count by ServiceName
You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?
EventCode 1
EventCode 11
EventCode 10
EventCode 10 records process access, capturing one process opening a handle to another with granted access rights. Memory access to lsass.exe by a non-standard process appears here, making it the primary Sysmon event for credential-dumping detection.
EventCode 3
When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?
Threat Intelligence Source List
Hunt Procedure and Query Logic
Documenting the procedure and the exact SPL queries lets another analyst rerun the same hunt and reproduce findings. This satisfies the stem's repeatability and auditability requirement, since the query logic records precisely what was searched and how results were interpreted.
Executive Summary
Hardware Requirements
Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?
Saved Search
Data Model Acceleration
Search Macro
Search macros store a reusable search fragment, optionally with arguments, letting analysts parameterise values such as time ranges or entities and invoke the same logic across many searches. This directly satisfies the requirement to save, parameterise, and reuse a query.
Event Type
Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?
Data Preparation
Reporting
Hunt Execution
Hypothesis Generation
Hypothesis Generation is the phase where hunters formulate a testable proposition about a specific threat actor or technique, defining what to investigate before data collection begins. It directly satisfies the stem's requirement to identify the actor or technique, preceding data gathering and analysis phases.
You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?
eval decoded=base64_decode(field)
The eval function base64_decode() converts a Base64-encoded string back to plaintext within a search, so the encoded PowerShell payload becomes readable. Applying it to the suspect field satisfies the stem's requirement to decode the string directly in Splunk.
rex field=field "(?<decoded>.*)"
transform base64 field
eval decoded=decode(field, "base64")
Want more Threat Hunting practice?
Practice this domainWhich command is used to visualize data in a time-series chart?
graph count _time
stats count over time
timechart count by sourcetype
The timechart command aggregates events into time buckets and plots them as a time-series chart, with the split-by clause producing one series per sourcetype. This directly produces the visualisation requested, unlike stats or table which return tabular output.
chart count by _time
Which command is used to rename a field in the results table for better readability?
table src_ip as "Source Address"
fields src_ip:"Source Address"
eval "Source Address" = src_ip
rename src_ip as "Source Address"
The `rename` command changes a field's name in the results table without altering its values, satisfying the readability requirement. Using `as` with a quoted alias, `rename src_ip as "Source Address"` relabels the column header, unlike `eval`, which creates a new field while leaving the original intact.
You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?
Subsearches are limited by the 'maxout' configuration and execution time.
Subsearches run first and their results are injected into the outer search, so they are bounded by the maxout setting (default 50,000 results) and the subsearch execution time limit. Exceeding either silently truncates results, which is the constraint to consider here.
Subsearches only return the first 10 results.
Subsearches cannot use the 'stats' command.
Subsearches cannot reference fields from the outer search.
Subsearches always run after the outer search completes.
You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?
eval json_parse(raw_data)
spath input=raw_data
spath parses structured data such as JSON and XML, extracting nested fields into searchable fields. Specifying input=raw_data tells Splunk to read that field's JSON content and expose each key as a field for use in the SPL pipeline.
json raw_data
extract json raw_data
You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?
saveas lookup ioc_list.csv
outputlookup ioc_list.csv
outputlookup writes search results back to a lookup file, overwriting or appending to the named CSV. This lets newly discovered IOCs from the current search persist into ioc_list.csv for enrichment in later searches, satisfying the dynamic update requirement.
write ioc_list.csv
inputlookup ioc_list.csv --append
What is the purpose of the 'head' command?
Return the last N results.
Sort the results.
Count the results.
Return the first N results.
The `head` command returns the first N results from a search, satisfying the requirement to limit output to the earliest events in the result set. Unlike `tail`, which returns the last N results, `head` preserves the original sort order and truncates from the beginning, making it the precise tool for previewing initial results.
Want more SPL Search Proficiency practice?
Practice this domainWhich phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?
Installation.
Command and Control (C2).
Egress filtering blocks outbound traffic to attacker-controlled infrastructure, severing the channel established during Command and Control. Since C2 depends on beaconing from the compromised host to external servers, restricting outbound destinations directly disrupts this phase, satisfying the strict egress constraint.
Reconnaissance.
Exploitation.
An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?
Domain Controller authentication logs.
Email gateway logs and web proxy logs.
The Delivery phase covers weaponisation and transmission, where malicious payloads reach the victim. Email gateway and web proxy logs capture delivery vectors such as phishing attachments and drive-by downloads, directly evidencing this stage rather than exploitation or command-and-control.
Internal host process creation logs.
Endpoint file integrity monitoring.
Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?
Vulnerability Data Model.
Assets and Identity Data Model.
The Assets and Identity Data Model normalises asset inventory fields such as hostnames, IP addresses and ownership, which the CIS Control 1 requirement for tracking enterprise assets depends on. It is the only model providing that asset-centric visibility for Splunk searches.
Endpoint Data Model.
Network Traffic Data Model.
You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?
Splunk Add-on for Linux Auditd.
Splunk App for Infrastructure (SAI).
Splunk App for CIS Benchmarks.
The Splunk App for CIS Benchmarks provides prebuilt dashboards, data models and correlation searches that ingest CIS-CAT assessment output and report pass/fail per control, directly satisfying the requirement to ingest and report Linux CIS compliance checks without custom field extraction or search development.
Splunk Enterprise Security Vulnerability Scanner.
Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?
Establishing a persistent connection to the attacker.
Executing code to take advantage of a vulnerability.
Exploitation is the phase where an attacker leverages a discovered weakness by running code or a crafted payload against it, turning a vulnerability into actual access or execution. It follows weaponisation and delivery, and precedes installation, so its defining goal is triggering the flaw to gain a foothold.
Exfiltrating sensitive company data.
Gathering information about the target.
A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?
Email security logs or Web Proxy logs.
Initial Access covers techniques such as phishing and drive-by compromise, which arrive via email attachments, links, or malicious web content. Email security and web proxy logs record those delivery vectors, giving the primary evidence needed to trace how the intrusion began.
Local authentication logs.
Process audit logs.
Registry modification logs.
Want more Cyber Landscape And Industry Frameworks practice?
Practice this domainThe SPLK-5001 exam has 66 questions and must be completed in 75 minutes. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: SIEM Defenses And Data Practices, Investigation And Risk Management, Threat And Attack Types, Threat Hunting, SPL Search Proficiency, Cyber Landscape And Industry Frameworks. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Splunk SPLK-5001 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.