SPLK-5001 Practice Test 10 — 10 Questions

Question 1

When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?

Accepted Answer

To attribute risk to a specific object, such as a user or system.. The Risk Analysis adaptive response action in a correlation search is used to attribute risk to a specific object (such as a user, system, or IP) by adding a risk score and risk message to that object. This feeds into the risk-based alerting framework, allowing ES to accumulate risk and generate notables when thresholds are exceeded.

Answer

To purge malicious events from the index.

Answer

To notify the SOC manager via email.

Answer

To automatically block the offending IP address on the firewall.

Question 2

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

Accepted Answer

Configure > Threat Intelligence > Threat Sources. In Splunk Enterprise Security, threat intelligence sources are configured and monitored under Configure > Threat Intelligence > Threat Sources. This page lists all configured intelligence sources, their status (enabled/disabled), last update time, and any errors, allowing you to confirm active ingestion. It is the authoritative location for verifying threat feed health.

Answer

Configure > Data Inputs

Answer

Dashboard > Threat Intelligence

Answer

Configure > Content Management

Question 3

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

Accepted Answer

Change Analysis. The Change Analysis CIM data model is designed to capture changes to system configuration, including audit policy modifications. When auditpol.exe is used to alter audit policies, the resulting Windows Security event (typically Event ID 4719, 'System audit policy was changed') maps to Change Analysis via fields like object, change_type, and user. Network Traffic, Endpoint, and Authentication models do not represent configuration-change events.

Answer

Network Traffic

Answer

Endpoint

Answer

Authentication

Question 4

A security team wants to align their Splunk Enterprise Security (ES) deployment with the NIST Cybersecurity Framework (CSF) 2.0 to improve governance and risk management. They are specifically focused on the 'Identify' function. Which of the following activities best exemplifies the use of Splunk ES to support the 'Identify' function?

Accepted Answer

Using the Asset and Identity framework to maintain an up-to-date inventory of critical systems and their owners.. The Identify function in NIST CSF 2.0 focuses on understanding the cybersecurity risks to systems, people, assets, data, and capabilities. Splunk ES's Asset and Identity framework provides a centralized way to manage and correlate asset information, which is essential for identifying what needs protection and assessing risk. This directly supports the Identify function by maintaining an accurate inventory and context for critical assets, enabling effective governance and risk management.

Answer

Using the Risk Analysis dashboard to prioritize vulnerabilities based on asset criticality and threat intelligence.

Answer

Configuring correlation searches to detect unauthorized access attempts and generate notable events.

Answer

Implementing automated response actions to isolate infected endpoints upon detection of malware.

Question 5

During an investigation, an analyst observes multiple `Endpoint` events where `lsass.exe` is accessed with `PROCESS_VM_READ` by a non-standard binary named `diagtrack.exe` running from `C:\Users\Public\`. Which Splunk ES data model and field combination best supports detecting this credential-dumping behavior?

Accepted Answer

Endpoint data model, correlating `process_name` and `process_id` with `access` events from the `Processes` node. Detecting credential dumping requires visibility into process access events, which the Endpoint data model provides through its Processes node. By correlating the source binary with the target lsass.exe and the granted access mask, Splunk ES can identify suspicious memory reads that are characteristic of tools like Mimikatz or custom dumpers, even when the binary name is masqueraded.

Answer

Network_Traffic data model, filtering on `dest_port` and `bytes_out` to detect exfiltration

Answer

Authentication data model, using `user` and `src` fields to identify failed logon attempts

Answer

Change_Analysis data model, monitoring registry key modifications under `HKLM\SAM`

Question 6

Which component in the Splunk ES architecture is responsible for mapping disparate log sources to a unified schema?

Accepted Answer

Common Information Model (CIM) Add-on. The Common Information Model (CIM) Add-on in Splunk ES provides the field mappings and knowledge objects that normalize disparate log sources into a unified schema. It defines the data models (Authentication, Endpoint, Network Traffic, etc.) and the field aliases, tags, and event types required to populate them, enabling consistent searches and correlation across heterogeneous data.

Answer

Notable Event Suppression

Answer

Splunk Enterprise Security App

Answer

Splunk Indexer

Question 7

Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?

Accepted Answer

The Search Head.. In Splunk Enterprise Security, correlation searches run on the Search Head, and their alert actions (including the 'notable' action) generate notable events. The Search Head is where ES app components — correlation searches, data models, and the notable event framework — execute. Indexers store raw data, forwarders send data, and the License Master manages licensing; none of these generate notables.

Answer

The Forwarder.

Answer

The License Master.

Answer

The Indexer.

Question 8

In the context of Splunk ES, what is an 'Asset'?

Accepted Answer

An entity like a host or server.. In Splunk Enterprise Security, an 'Asset' is a normalized representation of an entity such as a host, server, endpoint, or device that is part of the IT infrastructure. Assets are defined in the Asset and Identity framework via CSV lookups and are used to enrich events with context (e.g., owner, priority, category). A malicious IP address is a threat indicator, not an asset.

Answer

A malicious IP address.

Answer

A saved search report.

Answer

A notable event.

Question 9

Which THREE components are required for an Adaptive Response action to function?

Accepted Answer

The Adaptive Response action must be enabled.. Option A is correct because an Adaptive Response action must be explicitly enabled in the Splunk ES configuration before it can be triggered; a disabled action will never execute even if all other prerequisites are met. Option C is correct because Adaptive Response actions that reach out to external systems (for example, running a script or invoking a third-party API) require validated credentials for the target system so the action can authenticate and perform its task. Option E is correct because a properly configured add-on for the target system is needed to provide the integration, capabilities, and supporting binaries or scripts that the Adaptive Response action relies on. Option B is not required because Adaptive Response actions operate within the customer's environment and do not need a permanent Internet connection. Option D is not required because the 'Admin' role on all indexers is not a prerequisite for an Adaptive Response action to function; the necessary permissions relate to the action and its target, not to indexer-wide admin rights.

Answer

A permanent connection to the Internet.

Answer

A user with 'Admin' role on all indexers.

Question 10

A security analyst needs to quickly identify which users have logged in from more than three distinct source IP addresses in the last 24 hours. Which SPL command correctly calculates the number of distinct source IPs per user?

Accepted Answer

stats dc(src_ip) as ip_count by user. The dc function in the stats command calculates the distinct count of a field. Using dc(src_ip) by user directly returns the number of unique source IPs for each user, which is exactly what is needed to find users with more than three distinct IPs. It is efficient and avoids the pitfalls of counting total events or using dedup incorrectly.

Answer

stats values(src_ip) as ip_list by user | eval ip_count = mvcount(ip_list)

Answer

dedup src_ip | stats count by user

Answer

stats count(src_ip) as ip_count by user