SPLK-5001 Practice Test — Free Splunk Certified Cybersecurity Defense Analyst (SPLK-5001) (SPLK-5001) Questions with Explanations

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

A user reports that their files have been encrypted and a ransom note is displayed on their screen. Which type of malware is most likely responsible?

You are hunting for beaconing activity in proxy logs ingested into Splunk, where an implant contacts its command-and-control server at regular intervals with small jitter. Which analytic approach best identifies a host exhibiting this periodic communication pattern?

What is the purpose of the 'map' command in complex searches?

A Splunk security analyst is mapping the organization's detection capabilities to the NIST Cybersecurity Framework (CSF) Core functions. The analyst wants to ensure that the team can effectively identify anomalous activity across the enterprise. Which CSF function should the analyst prioritize to meet this objective?

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that was generated from a correlation search firing against a risk index. The analyst wants to see the individual risk events that contributed to the notable's risk score, including the contributing risk rules and their individual risk scores. Which action should the analyst take?

A Splunk ES analyst is tuning a correlation search that generates a large number of false positives. The analyst wants to reduce noise without disabling the search entirely. The search currently uses a risk rule that assigns a risk score of 20 to each matching event. Which approach best aligns with risk-based alerting best practices?

When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?

When a notable event is generated, where does the 'Risk Score' value originate?

During an investigation of a suspected malware outbreak, an analyst needs to identify all internal hosts that have communicated with a known malicious IP address. Which Splunk ES data model should be used to search for this network communication?

A Splunk ES analyst is reviewing an incident where an attacker used a compromised user account to move laterally within the network. The analyst wants to map this activity to the MITRE ATT&CK framework. Which tactic best describes the attacker's actions?

What does the 'OR' operator do in a search?

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

A junior analyst is asked to find all risk events associated with a specific user account to assess potential insider threat activity. Which search command should the analyst use to retrieve these risk events from the risk index?

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration incident. The analyst wants to determine the stage of the attack according to the Cyber Kill Chain. The analyst observes that a large volume of data is being transferred from an internal database server to an external IP address. Which phase of the Cyber Kill Chain does this activity represent?