SPLK-5001 Practice Test 12 — 15 Questions

Question 1

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

Accepted Answer

The search logic does not match the data.. If the search returns no results, the logic inside the search is likely too restrictive, such as incorrect data model mapping or field names.

Answer

The Splunk indexer is overloaded.

Answer

The user does not have permission to write to the risk index.

Answer

The Risk Analysis action is disabled.

Question 2

When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?

Accepted Answer

Creates an entry in the Incident Review dashboard.. The 'Notable' action type specifically triggers the creation of a notable event in the Incident Review dashboard.

Answer

Updates the asset identity table.

Answer

Assigns a risk score to an event.

Answer

Sends an email alert.

Question 3

Which TWO methods can be used to suppress notable events?

Accepted Answer

Directly modifying the 'notable_event_suppression' KV Store collection.. Suppression can be done via the UI (Incident Review) or by creating entries in the Notable Event Suppression lookup.

Answer

Restarting the search head cluster.

Answer

Renaming the index.

Answer

Adding a block to the inputs.conf.

Question 4

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Accepted Answer

The 'notable' index logs.. Scheduler logs, search job inspector, and the internal notable event index are all key to diagnosing search failures.

Answer

The Splunk License usage report.

Answer

The user's web browser cache.

Question 5

What is the purpose of the 'Assets and Identities' framework in Splunk ES?

Accepted Answer

To provide context like department and role to security events.. This framework enriches events with contextual information such as business unit, ownership, and priority.

Answer

To manage user passwords.

Answer

To store audit logs for compliance.

Answer

To define the network topology.

Question 6

You need to ensure that the 'Threat Intelligence' framework periodically updates. Where do you configure the update interval?

Accepted Answer

In the Threat Intelligence Manager dashboard.. The Threat Intelligence Manager allows you to define the update interval for individual threat feeds.

Answer

Using a crontab on the OS level.

Answer

By modifying the threat data model.

Answer

In the global settings.conf file.

Question 7

You need to modify the default 'Risk Score' logic for a specific asset. Where should this customization occur?

Accepted Answer

In the 'Risk Scoring' configuration or via lookup tables.. The 'Risk Analysis' framework or 'Risk Scoring' configuration pages allow for modifying how scores are calculated for specific assets.

Answer

By changing the sourcetype definition.

Answer

In the 'limits.conf' file.

Answer

By editing the 'notable_event' python script.

Question 8

You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?

Accepted Answer

The input configuration within the Splunk Add-on for Microsoft Windows.. To ensure CIM compliance, data should be mapped to the appropriate CIM tags and fields. Configuring the sourcetype correctly in props.conf and transforms.conf (or via the Add-on Builder) ensures the data is parsed and tagged into the Authentication data model correctly.

Answer

The data model acceleration settings in the ES app settings.

Answer

The index-time index routing configuration in indexes.conf.

Answer

The Notable Event Suppression configuration in Splunk ES.

Question 9

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

Accepted Answer

In the 'Comments' section of the Case.. Case Management supports adding comments or notes to a case to facilitate collaboration.

Answer

In the splunkd.log file.

Answer

By modifying the correlation search.

Answer

In the Asset and Identity manager.

Question 10

Which THREE dashboard categories in Splunk ES are most useful for risk-based investigation?

Accepted Answer

Risk Analysis. Risk Analysis, Incident Review, and Security Posture are the primary dashboards for investigation.

Answer

License Usage

Answer

User Activity Monitoring

Question 11

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

Accepted Answer

Enable acceleration and define a summary range.. Acceleration must be enabled and the summary range must be set to cover the retention period required for security investigations.

Answer

Configure the data model to use only indexed fields.

Answer

Set the data model to root-level permissions only.

Answer

Manually create tags for every field in the data model.

Question 12

When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?

Accepted Answer

To attribute risk to a specific object, such as a user or system.. The Risk Analysis action adds risk events to the Risk Index, which allows for the aggregation of multiple low-fidelity alerts into a high-fidelity risk score for a specific entity.

Answer

To purge malicious events from the index.

Answer

To notify the SOC manager via email.

Answer

To automatically block the offending IP address on the firewall.

Question 13

Which command is used to rename a field in the results table for better readability?

Accepted Answer

rename src_ip as "Source Address". The rename command allows changing the display name of a field.

Answer

table src_ip as "Source Address"

Answer

fields src_ip:"Source Address"

Answer

eval "Source Address" = src_ip

Question 14

You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?

Accepted Answer

outputlookup ioc_list.csv. The 'outputlookup' command writes search results to a lookup file.

Answer

saveas lookup ioc_list.csv

Answer

write ioc_list.csv

Answer

inputlookup ioc_list.csv --append

Question 15

What is the purpose of the 'map' command in complex searches?

Accepted Answer

Runs a subsearch for each event in the results.. The 'map' command executes a search for each event in the results.

Answer

Maps IP addresses to locations.

Answer

Maps fields to a dashboard.

Answer

Creates a map visualization.