SPLK-5001 Practice Test 1 — 10 Questions

Question 1

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Accepted Answer

Reconnaissance. The Cyber Kill Chain consists of Reconnaissance, Weaponization, Delivery, Exploitation, Installation, C2, and Actions on Objectives.

Answer

Containment

Answer

Patching

Question 2

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

Accepted Answer

Utilizing the 'mitre_attack_id' field within the Threat Intelligence framework.. The MITRE ATT&CK mapping in ES relies on the 'mitre_attack_id' field within the threat intelligence framework to correlate events with the enterprise matrix.

Answer

Hardcoding the technique description into the 'dest_host' field.

Answer

Configuring the 'correlation_rule_id' to match the ATT&CK tactic name.

Answer

Mapping the source IP to the 'mitre_source_id' field.

Question 3

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

Accepted Answer

Domain Names. ES allows for the management of Indicators of Compromise (IoCs) including IP addresses, file hashes, and domain names.

Answer

User Session Tokens

Answer

Network Topology Maps

Question 4

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Accepted Answer

Enablement of the 'Splunk App for CIS Benchmarks'.. To report on CIS benchmarks, you need to collect the configuration data and have a mechanism to compare it against the expected state (the benchmark).

Answer

Configure all logs to use the 'Syslog' protocol only.

Answer

Install a third-party antivirus solution.

Answer

Configure the index to 'Hot/Warm' storage only.

Question 5

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

Accepted Answer

Command and Control (C2).. Egress filtering prevents infected hosts from communicating with external Command and Control (C2) servers.

Answer

Installation.

Answer

Reconnaissance.

Answer

Exploitation.

Question 6

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

Accepted Answer

Notable Events framework.. The 'Notable Events' framework and 'Correlation Searches' are the primary mechanisms in ES for detecting and surfacing security anomalies.

Answer

Workload Management.

Answer

Data Model acceleration.

Answer

Report acceleration.

Question 7

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Accepted Answer

Scanning external IP ranges for open ports.. Reconnaissance involves active or passive research performed by an attacker to gather information on a target's infrastructure.

Answer

Sending a spear-phishing email.

Answer

Encrypting user files for ransom.

Answer

Installing a backdoor on a web server.

Question 8

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

Accepted Answer

Detect. The five core functions of NIST CSF are Identify, Protect, Detect, Respond, and Recover.

Answer

Report

Answer

Eradicate

Question 9

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

Accepted Answer

Case Management. Case Management provides the structure and tools for incident lifecycle management.

Answer

Notable Event Suppression

Answer

Risk Analysis Dashboard

Answer

Incident Review

Question 10

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

Accepted Answer

Risk Analysis Dashboard. The 'Risk Analysis' dashboard displays a timeline and list of events that contributed to an object's current risk score.

Answer

Security Posture Dashboard

Answer

Investigation Workbench

Answer

Incident Review