SPLK-5001 Exam Simulation 1 — 100 Questions

Question 1

You are reviewing the data ingestion pipeline for Splunk Enterprise Security. To ensure that the CIM (Common Information Model) is correctly applied to your data, which two actions are required when configuring a new data source? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the appropriate tags to the data source or fields.. To make a new data source CIM-compliant, you must map vendor-specific fields to CIM field names using field aliases and apply the correct tags to associate events with the appropriate data models. These two actions ensure that the data is normalized and included in the CIM, enabling correlation searches and other ES features to work correctly.

Answer

Create a new event type that tags the relevant fields.

Answer

Enable data model acceleration for all data models.

Answer

Create a new index for the data source.

Question 2

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Accepted Answer

Splunk Index Manager interface.. The 'risk' index is a standard Splunk index, so its retention (frozenTimePeriodInSecs) is managed through the Splunk Index Manager interface (Settings > Indexes in Splunk Web, or indexes.conf). ES does not override index retention through its own app settings, so the Index Manager is the correct place to modify retention for the risk index.

Answer

ES app settings.

Answer

Data model acceleration settings.

Answer

Correlation Search Editor.

Question 3

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Accepted Answer

Correlation Search Editor. Risk rule weights are defined as part of the correlation search definition itself, so the weight is edited in the Correlation Search Editor within Enterprise Security. The editor exposes the risk analysis configuration, including the risk object fields and the risk score/weight assigned when the search fires. Changing the weight anywhere else would not affect how the correlation search writes risk events.

Answer

Identity Manager

Answer

Risk Index Configuration

Answer

Risk Notable Settings

Question 4

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that was generated from a correlation search firing against a risk index. The analyst wants to see the individual risk events that contributed to the notable's risk score, including the contributing risk rules and their individual risk scores. Which action should the analyst take?

Accepted Answer

Open the Notable Event in the Incident Review dashboard and use the Risk Event drilldown to view the contributing risk events.. The Risk Event drilldown available from the Incident Review dashboard is purpose-built to expose the individual risk events that aggregate into a notable's risk score. It shows each contributing risk rule, the risk object, and the associated risk score, enabling the analyst to understand the composition of the notable and investigate the root causes efficiently within Splunk Enterprise Security.

Answer

Review the ES Audit dashboard to identify which correlation searches recently fired and generated risk events.

Answer

Use the Threat Intelligence framework to correlate the notable's source IP against known threat indicators.

Answer

Run a search against the risk index filtering by the notable's event ID to retrieve the associated risk events.

Question 5

A Splunk ES analyst is tuning a correlation search that generates a large number of false positives. The analyst wants to reduce noise without disabling the search entirely. The search currently uses a risk rule that assigns a risk score of 20 to each matching event. Which approach best aligns with risk-based alerting best practices?

Accepted Answer

Adjust the search's risk rule to assign a lower risk score and add a filter to exclude known benign activity.. Tuning a noisy risk rule should involve refining the detection logic to exclude benign activity and adjusting the risk score to reflect the rule's true severity. This reduces false positives without sacrificing detection coverage. Simply raising the score, throttling, or disabling the search either fails to address the root cause or removes detection capability. The best practice is to iteratively tune the risk rule based on observed false positives.

Answer

Increase the risk score to 100 so that only high-risk events trigger notables.

Answer

Add a throttle to the correlation search to suppress duplicate notable events.

Answer

Disable the correlation search and create a new one with a different name.

Question 6

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

Accepted Answer

Owner.. In the Incident Review dashboard, notable events are triaged using the fields that describe the state and assignment of each notable, so Owner (B) is correct because filtering by owner lets analysts isolate the notables assigned to a specific person or team. Status (C) is correct because notables carry review states such as New, In Progress, Pending, Resolved, and Closed, and filtering by status is a primary way to find unreviewed or open items. Urgency (E) is correct because urgency (Critical, High, Medium, Low, Informational) is a core notable attribute used to prioritize and filter the highest-priority incidents. License type (A) is not a notable-event attribute but a Splunk deployment/licensing property, and index name (D) is an underlying data-source detail rather than a standard Incident Review filter attribute.

Answer

License type.

Answer

Index name.

Question 7

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Accepted Answer

The 'Notable' adaptive response action is not enabled in the search configuration.. For a correlation search's results to appear in Incident Review, the search must include the 'Notable' adaptive response action in its configuration. Without this action enabled, the search runs and returns results, but no notable events are written to the notable index, so Incident Review shows nothing. This is the most common cause of 'search fires but no notables appear.'

Answer

The correlation search schedule is set to 'Real-time'.

Answer

The user does not have the 'ess_admin' role.

Answer

The data model acceleration is lagging.

Question 8

A SOC manager is configuring a new correlation search in Splunk ES to detect potential data exfiltration. The search should trigger a notable event and also automatically create a ticket in the organization's ticketing system via a third-party API. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure a custom alert action that sends a REST API call to the ticketing system.. To generate a notable event, the correlation search must have the notable event action enabled. To create a ticket via API, a custom alert action that makes the API call must be configured and added to the search's alert actions. These two actions together fulfill the requirements.

Answer

Create a saved search that runs the correlation search and sends an email.

Answer

Enable the risk analysis framework to assign a risk score to the user.

Answer

Set up a data model acceleration for the index containing the exfiltration data.

Question 9

When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?

Accepted Answer

Run the search query logic manually in the Search app.. Running the correlation search's SPL logic manually in the Search app is the definitive way to verify whether the underlying query returns events. If the raw search produces results but no notable event appears, the problem lies in the alert action, throttling, or suppression configuration rather than the search logic itself. This isolates the search engine behavior from the correlation search scheduling and alerting pipeline.

Answer

index=notable

Answer

Check the 'scheduler.log'.

Answer

Re-index the source data.

Question 10

A Splunk ES analyst is investigating a potential ransomware incident. Which TWO of the following are valid indicators of ransomware activity that should be prioritized for detection? (Choose two.)

Accepted Answer

A sudden increase in SMB write operations to a single file server from multiple hosts. Ransomware's core behaviors are mass file encryption and lateral spread, often via SMB. Detecting high-volume file renames with ransomware extensions and spikes in SMB writes to shared servers directly targets these behaviors, providing actionable alerts. Other options are either unrelated or too nonspecific to prioritize.

Answer

A single failed login attempt from an external IP address

Answer

An increase in DNS queries for known cryptocurrency mining pools

Answer

A user reporting slower than usual workstation performance

Question 11

What is the purpose of the 'map' command in complex searches?

Accepted Answer

Runs a subsearch for each event in the results.. The map command in Splunk is a streaming subsearch command that iterates over each result row and runs a specified subsearch once per row, injecting the current row's field values into the subsearch. It is used to enrich or correlate events by executing a nested search for every event returned by the outer search. This makes it fundamentally a per-event subsearch executor, not a geolocation or visualization tool.

Answer

Maps IP addresses to locations.

Answer

Maps fields to a dashboard.

Answer

Creates a map visualization.

Question 12

A Splunk security analyst is mapping the organization's detection capabilities to the NIST Cybersecurity Framework (CSF) Core functions. The analyst wants to ensure that the team can effectively identify anomalous activity across the enterprise. Which CSF function should the analyst prioritize to meet this objective?

Accepted Answer

Detect. The NIST CSF Detect function is specifically designed to identify the occurrence of cybersecurity events through continuous monitoring and anomaly detection. To ensure the team can effectively identify anomalous activity, the analyst should prioritize the Detect function, which encompasses detection processes and technologies like Splunk ES. This function provides the necessary capabilities to discover threats in a timely manner.

Answer

Respond

Answer

Protect

Answer

Identify

Question 13

When a notable event is generated, where does the 'Risk Score' value originate?

Accepted Answer

From the correlation search's defined risk factor.. The Risk Score on a notable event originates from the risk factor defined in the correlation search that generated it. When a correlation search is configured, it specifies a risk score (risk_score) and risk object; that score is attached to the risk event and, when thresholds are crossed, contributes to the notable's risk score. Thus the correlation search's defined risk factor is the source.

Answer

From the number of events in the result set.

Answer

From the indexer's CPU load.

Answer

From the user's login history.

Question 14

A user reports that their files have been encrypted and a ransom note is displayed on their screen. Which type of malware is most likely responsible?

Accepted Answer

Ransomware. The scenario describes files being encrypted and a ransom note displayed, which are the defining characteristics of ransomware. Ransomware encrypts data and demands payment for decryption. Trojans, worms, and rootkits have different behaviors: Trojans deceive, worms self-replicate, and rootkits hide. None of these directly cause file encryption with a ransom demand.

Answer

Worm

Answer

Trojan

Answer

Rootkit

Question 15

During an investigation of a suspected malware outbreak, an analyst needs to identify all internal hosts that have communicated with a known malicious IP address. Which Splunk ES data model should be used to search for this network communication?

Accepted Answer

Network_Traffic. The Network_Traffic data model is designed to capture network flow data, including source and destination IP addresses, ports, and protocols. In a malware outbreak, identifying all internal hosts that have communicated with a known malicious IP is critical for scoping the incident. By searching this data model, the analyst can quickly generate a list of affected hosts and the associated traffic details, enabling effective containment and remediation.

Answer

Authentication

Answer

Intrusion_Detection

Answer

Endpoint.Processes

Question 16

You are hunting for beaconing activity in proxy logs ingested into Splunk, where an implant contacts its command-and-control server at regular intervals with small jitter. Which analytic approach best identifies a host exhibiting this periodic communication pattern?

Accepted Answer

Compute the standard deviation or variance of the inter-arrival times between successive connections from each host to each destination, then flag destinations with low variance and regular spacing.. Periodic command-and-control check-ins reveal themselves through the regularity of connection timing rather than through volume. Calculating the variance of inter-arrival times between a host and each destination, then flagging pairs with low variance and consistent spacing, isolates beacon-like behavior even when jitter is present, because the underlying cadence remains far more regular than human or application traffic.

Answer

Aggregate bytes transferred per destination and alert when a single destination exceeds a fixed threshold of total data volume per hour.

Answer

Search for any destination whose fully qualified domain name was registered within the last 30 days using a passive DNS lookup and alert on all contacts to it.

Answer

Count total outbound connections per source host per day and alert on any host in the top decile of connection volume.

Question 17

A Splunk ES analyst is reviewing an incident where an attacker used a compromised user account to move laterally within the network. The analyst wants to map this activity to the MITRE ATT&CK framework. Which tactic best describes the attacker's actions?

Accepted Answer

Lateral Movement. The MITRE ATT&CK tactic Lateral Movement describes techniques used by attackers to move through a network after gaining initial access. Using a compromised user account to access other systems is a primary example of this tactic. It allows attackers to expand their foothold, access additional resources, and potentially escalate privileges. Therefore, Lateral Movement is the correct mapping for this activity.

Answer

Initial Access

Answer

Privilege Escalation

Answer

Execution

Question 18

An attacker has gained access to a workstation and is attempting to move laterally within the network. Which TWO of the following techniques are commonly used for lateral movement that you should monitor in Splunk ES? (Choose two.)

Accepted Answer

Remote Desktop Protocol (RDP) hijacking. Lateral movement involves techniques that allow an attacker to move from one compromised system to another within a network. Pass-the-Hash and RDP hijacking are both established methods for achieving this. SQL injection, XSS, and phishing are attack types that target different stages: SQL injection and XSS are web application attacks, and phishing is an initial access vector. Thus, only Pass-the-Hash and RDP hijacking are correct.

Answer

Phishing

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 19

What does the 'OR' operator do in a search?

Accepted Answer

Matches either condition.. In Splunk Search Processing Language, the OR operator is a Boolean operator that returns events matching either of the two conditions it connects. For example, `status=200 OR status=404` returns events where status equals 200 or status equals 404 (or both). It is the inclusive disjunction, not exclusive, so events satisfying both conditions are also returned.

Answer

Excludes the specified condition.

Answer

Matches both conditions.

Answer

Matches only the first condition.

Question 20

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

Accepted Answer

Case Management. Case Management in Splunk Enterprise Security is the component that manages the lifecycle of an incident, including status updates, assignments, and other workflow actions. It allows analysts to create cases from notable events, track their progress, and collaborate on investigations. This is distinct from Incident Review, which is primarily for viewing and triaging notable events, not for managing the full incident lifecycle.

Answer

Notable Event Suppression

Answer

Risk Analysis Dashboard

Answer

Incident Review