SPLK-5001 Practice Test 11 — 15 Questions

Question 1

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Accepted Answer

Asset and Identity framework using lookup tables.. The 'Asset and Identity' framework in ES allows for the ingestion of authoritative lists of software and assets for comparison against endpoint logs.

Answer

Index-time field extraction.

Answer

Correlation search thresholding.

Answer

Dynamic Threat Intelligence updates.

Question 2

Which THREE features are provided by the Splunk ES Incident Review dashboard?

Accepted Answer

Status management. The Incident Review dashboard is the hub for notable event triage, status tracking, and assignment.

Answer

Risk score threshold configuration

Answer

Threat intelligence feed management

Question 3

Which THREE actions are part of the 'Incident Review' investigation workflow?

Accepted Answer

Changing the status of a notable. Investigating involves triaging, assigning, and changing statuses.

Answer

Updating system configuration files

Answer

Rebooting indexer nodes

Question 4

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

Accepted Answer

The scores are additive.. The 'sum' aggregation method cumulatively adds the risk score of every incident to the total score of the object.

Answer

Only the highest score is kept.

Answer

The scores are averaged.

Answer

The risk score is reset to zero.

Question 5

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

Accepted Answer

The value added to the object's risk score.. The 'risk_score' is the value assigned to an event to quantify the level of risk associated with that activity.

Answer

The severity level of the notable event.

Answer

The threshold for triggering a notable.

Answer

The total risk score for the object.

Question 6

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

Accepted Answer

Risk Analysis configuration in ES Settings.. The 'Risk Analysis' settings in the ES app configuration dictate how long risk scores persist before decaying.

Answer

Data model acceleration TTL.

Answer

Search Scheduler settings.

Answer

Notable event retention settings.

Question 7

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Accepted Answer

Splunk Index Manager interface.. Index retention policies are managed in the Splunk index settings (indexes.conf) or via the Manager interface.

Answer

ES app settings.

Answer

Data model acceleration settings.

Answer

Correlation Search Editor.

Question 8

Which TWO actions should be taken if a correlation search is consuming too many system resources?

Accepted Answer

Reduce the search frequency (cron schedule).. Optimizing the search query and reducing the search frequency (cron) are the primary ways to reduce resource impact.

Answer

Re-install the Splunk Enterprise application.

Answer

Delete all historical data.

Answer

Switch to a different operating system.

Question 9

You need to calculate the average time delta between 'login' and 'logout' events for each user. Which command approach is most effective?

Accepted Answer

index=auth | transaction user_id | stats avg(duration) by user_id. Transaction is effective for grouping events by a common ID and calculating duration.

Answer

index=auth | delta _time as time_diff by user_id

Answer

index=auth | stats min(_time) as start, max(_time) as end by user_id | eval delta=end-start

Answer

index=auth | eval time_diff = logout_time - login_time

Question 10

When using 'stats', how can you include the values of a field as columns in your output?

Accepted Answer

stats count by host, sourcetype | xyseries host, sourcetype, count. The 'xyseries' or 'chart' command is used to create columns from field values.

Answer

stats count by host, sourcetype

Answer

stats count by host | transpose

Answer

stats pivot host sourcetype

Question 11

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

Accepted Answer

A KV Store collection configured via the 'Threat Intelligence Manager'.. The Threat Intelligence framework in ES supports importing custom feeds via CSV or KV Store lookups formatted as threat intel objects, often mapped to MITRE via STIX/TAXII integrations.

Answer

An XML-based 'Incident Review' dashboard export.

Answer

A custom .yml file uploaded to the /etc/system/local directory.

Answer

A static .conf file in the app bin folder.

Question 12

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

Accepted Answer

To alert when an object's risk score exceeds a threshold.. The 'Risk Notable' search monitors the 'risk' index and triggers a notable event when an object's aggregated risk score exceeds a defined threshold.

Answer

To clear old risk events from memory.

Answer

To generate risk events from logs.

Answer

To update the asset and identity table.

Question 13

Which TWO methods can be used to suppress unwanted notable events?

Accepted Answer

Correlation search suppression. Notable event suppression and correlation search suppression are the standard ways to manage alert noise.

Answer

Deleting the raw event from the index

Answer

Changing the user account password

Answer

Disabling the data model

Question 14

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

Accepted Answer

Owner.. Analysts typically filter by status, urgency, and owner to manage their incident queue.

Answer

License type.

Answer

Index name.

Question 15

Which command would you use to filter out events where the 'status' field is 200?

Accepted Answer

search status!=200. The 'where' command or 'search' command can be used to filter events.

Answer

eval status!=200

Answer

where status=200

Answer

drop status=200