SPLK-5001 Practice Test 13 — 15 Questions

Question 1

A SOC manager is defining a new risk-based alerting (RBA) strategy in Splunk Enterprise Security. The manager wants to ensure that risk events are properly attributed to the correct entities so that risk scores aggregate accurately. Which two actions should the manager take when configuring risk rules? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign a risk score that reflects the severity and confidence of the detection.. Proper RBA configuration requires defining risk objects (such as user, src, dest) so that risk is attributed correctly, and assigning a risk score that reflects the detection's severity and confidence. These two actions ensure that risk events aggregate accurately and that risk scores are meaningful. Generating notables for every event, writing to the notable index, or running infrequently would all disrupt the RBA model and reduce its effectiveness.

Answer

Configure the risk rule to write to the notable index instead of the risk index.

Answer

Enable the risk rule to generate a notable event for every matching event.

Answer

Set the risk rule's schedule to run only once per day to reduce load.

Question 2

A SOC manager is defining requirements for a new detection that should contribute to an entity's risk profile in Splunk Enterprise Security. Which TWO characteristics must the detection have to properly contribute risk to an entity? (Choose two.)

Accepted Answer

The correlation search must be configured to generate a risk event with a defined risk object and risk score.. For a detection to contribute to an entity's risk profile, it must generate a risk event that specifies the affected entity through a risk object and includes a risk score contribution. These two elements allow the platform to attribute risk to the correct entity and adjust its score. Other attributes such as data model acceleration, ATT&CK mapping, or notable generation are optional enhancements, not requirements.

Answer

The detection must be mapped to a MITRE ATT&CK technique to be eligible for risk scoring.

Answer

The detection must create a notable event in addition to any risk event it produces.

Answer

The detection must use a data model that is accelerated to ensure timely risk event generation.

Question 3

An analyst is investigating a potential ransomware incident. They notice a high volume of file modifications with the .locky extension across multiple shared drives. Which Splunk ES data model is most appropriate to search for these file system changes?

Accepted Answer

Endpoint.Filesystem. The Endpoint.Filesystem data model is specifically designed to capture file system activity from endpoints, including file creation, modification, and deletion. In a ransomware scenario, the rapid appearance of files with a malicious extension like .locky across shared drives is a key indicator. Searching this data model allows the analyst to identify affected files, paths, and timestamps, facilitating containment and remediation.

Answer

Web

Answer

Network_Traffic

Answer

Authentication

Question 4

An analyst is reviewing Splunk Enterprise Security correlation search results and notices a notable event for a host named WEB-01 indicating a possible web shell. The analyst wants to quickly identify the exact command and URI used in the initial exploit. Which Splunk ES data model should the analyst examine to find the HTTP request method and URI associated with this event?

Accepted Answer

Web. The Web data model is specifically structured to normalize web server logs, making it the ideal source for HTTP request methods and URIs. When investigating a potential web shell, analysts need to examine the initial exploit's HTTP request to understand the attack vector. Other data models lack this application-layer detail, so the Web data model is the correct choice.

Answer

Network Traffic

Answer

Endpoint

Answer

Intrusion Detection

Question 5

An analyst is investigating a potential pass-the-hash attack. They want to search for successful authentications that used NTLM authentication where the source workstation differs from the destination workstation. Which Splunk ES data model and field combination is most appropriate?

Accepted Answer

Authentication data model, filtering on authentication_method=NTLM and src!=dest. The Authentication data model is the correct choice because it records authentication events with details like authentication_method, src, dest, and user. Pass-the-hash attacks typically manifest as successful NTLM authentications where the source workstation is different from the destination workstation, indicating lateral movement. By filtering on authentication_method=NTLM and src!=dest, the analyst can identify potential pass-the-hash activity, which is a critical step in detecting and responding to this attack.

Answer

Network_Traffic data model, filtering on dest_port=445 and src!=dest

Answer

Endpoint.Processes data model, filtering on process_name=lsass.exe and user=SYSTEM

Answer

Intrusion_Detection data model, filtering on signature=Pass-the-Hash

Question 6

An analyst in Splunk Enterprise Security is investigating a potential DNS tunneling attack. They need to identify hosts that are sending an unusually high number of DNS queries to a single external domain within a short time window. Which search provides the most direct evidence of this behavior?

Accepted Answer

index=dns sourcetype=stream:dns | stats count by src_ip, query | sort -count. DNS tunneling often involves a compromised host making numerous DNS queries to a single external domain to exfiltrate data. Aggregating counts by source IP and queried domain, then sorting by count, directly reveals this pattern. The other searches either omit the source IP, use irrelevant fields, or focus on unique domain counts, which are better suited for DGA detection rather than tunneling.

Answer

index=dns sourcetype=stream:dns | timechart span=1h count by query

Answer

index=dns sourcetype=stream:dns | stats dc(query) as unique_queries by src_ip | sort -unique_queries

Answer

index=dns sourcetype=stream:dns | stats sum(bytes) as total_bytes by dest_ip | sort -total_bytes

Question 7

An analyst is investigating a suspected DNS tunneling attack. They need to identify hosts that are generating an unusually high number of DNS queries with long, random-looking subdomains. Which Splunk search is most effective for this detection?

Accepted Answer

index=dns | eval subdomain_len=len(query) | where subdomain_len > 50 | stats count by src_ip | where count > 50. DNS tunneling encodes data in subdomains, resulting in long, high-entropy query names and a high volume of queries from a single host. The search that evaluates query length and then counts per source IP addresses both characteristics. The other searches either lack length analysis, use averages that miss outliers, or rely on known domain patterns that attackers can easily change.

Answer

index=dns | stats avg(len(query)) as avg_len by src_ip | where avg_len > 20

Answer

index=dns | stats count by src_ip, query | where count > 100

Answer

index=dns | search query="*.evil.com" | stats count by src_ip

Question 8

A Splunk ES analyst is investigating a series of notable events related to a possible DNS tunneling attack. The analyst wants to identify domains that are being queried with unusually high frequency or with long subdomain strings, which are common indicators of DNS tunneling. Which Splunk ES data model should the analyst use to efficiently search for these DNS query patterns?

Accepted Answer

Network Resolution. The Network Resolution data model is specifically built to normalize DNS and DHCP data, making it the primary source for DNS query analysis in Splunk ES. By searching this data model, analysts can detect anomalies such as high query volumes or unusually long subdomains, which are characteristic of DNS tunneling. Other data models lack the necessary DNS fields or focus on different protocols.

Answer

Network Traffic

Answer

Web

Answer

Intrusion Detection

Question 9

A security analyst needs to quickly identify all notable events that are assigned to them and are still open. Which Splunk ES dashboard provides this information with the ability to filter by owner and status?

Accepted Answer

Incident Review. The Incident Review dashboard is the primary interface for analysts to view, filter, and manage notable events. It includes filters for owner, status, urgency, and other fields, enabling an analyst to quickly find notables assigned to them that are still open. This dashboard also supports actions like assigning, commenting, and closing notables, making it the correct choice.

Answer

Audit

Answer

Security Posture

Answer

Threat Activity

Question 10

A security engineer is configuring a correlation search that should only trigger a notable event if the source IP is not in a list of known internal IP addresses. The list is maintained in a CSV file on the Splunk search head. Which Splunk ES feature should the engineer use to reference this list within the correlation search?

Accepted Answer

Create a lookup definition and use the lookup command in the correlation search.. Using a lookup definition and the lookup command enables the correlation search to dynamically reference the CSV file. This allows the search to filter out known internal IPs and trigger notables only for external sources. It is the most efficient and maintainable approach in Splunk ES.

Answer

Use a subsearch to query the CSV file directly with the inputlookup command.

Answer

Embed the list of IPs directly in the correlation search using a where clause.

Answer

Upload the CSV file as a threat intelligence feed and use the threat intelligence framework.

Question 11

A security analyst receives an alert about a possible DNS tunneling attack. They need to examine DNS query logs to identify unusually long domain names that might indicate data exfiltration. Which Splunk ES data model should they use?

Accepted Answer

Network_Resolution. The Network_Resolution data model is designed to capture DNS resolution events, including fields like query, answer, and query_type. DNS tunneling attacks often use long, encoded domain names to exfiltrate data. By searching this data model, the analyst can identify anomalies such as unusually long query names or high volumes of queries to a single domain, which are indicative of tunneling. This targeted approach enables efficient detection and response.

Answer

Endpoint.DNS

Answer

Network_Traffic

Answer

Web

Question 12

A security analyst is configuring a new correlation search in Splunk Enterprise Security to detect brute-force attacks. The analyst wants to ensure that the notable events generated by this search are properly categorized and can be easily tracked. Which two actions should the analyst perform when creating the correlation search? (Choose two.)

Accepted Answer

Assign a security domain to the correlation search.. Assigning a security domain and specifying an owner are two actions that directly enhance categorization and tracking of notable events. The security domain classifies the type of activity, while the owner provides accountability and facilitates filtering in Incident Review. These actions are part of the correlation search configuration and are considered best practices for managing notables effectively.

Answer

Configure a throttling window to prevent duplicate notable events.

Answer

Add the correlation search to a relevant use case library.

Answer

Set the correlation search's severity level to 'Critical'.

Question 13

A security analyst is new to Splunk Enterprise Security and needs to understand how data is normalized across different sources. They notice that events from different vendors have different field names for the same concept, such as 'user' versus 'username'. Which Splunk ES component is responsible for normalizing these fields to a common schema?

Accepted Answer

Data Models. Data Models are the component in Splunk ES that normalize data by mapping vendor-specific fields to a common schema, known as the Common Information Model (CIM). They define field aliases and calculations that transform extracted fields into standardized names, enabling correlation searches and dashboards to work across diverse data sources. Other components like correlation searches, lookups, and field extractions serve different purposes and do not perform normalization.

Answer

Lookup Tables

Answer

Field Extractions

Answer

Correlation Searches

Question 14

A Splunk ES analyst is investigating a series of notable events indicating possible pass-the-hash attacks. The events show successful authentications using NTLM from unusual source workstations to multiple servers. Which data model should the analyst query to correlate the authentication events and identify the compromised user accounts?

Accepted Answer

Authentication. Pass-the-hash involves authenticating with stolen NTLM hashes, so the Authentication data model is the primary source for login events. It contains the necessary fields to correlate source, destination, and user accounts. The other data models either focus on different telemetry or lack the authentication details required for this specific attack analysis.

Answer

Network_Traffic

Answer

Endpoint

Answer

Identity_Management

Question 15

A Splunk ES analyst is investigating a potential Kerberoasting attack. The analyst wants to identify the key indicators of this activity. Which TWO of the following are primary indicators of a Kerberoasting attack that the analyst should look for in Splunk ES? (Choose two.)

Accepted Answer

A single user account requesting an unusually high number of service tickets for different SPNs in a short time.. Kerberoasting is characterized by attackers requesting service tickets for SPNs and then cracking them offline. The two primary indicators are a high volume of service ticket requests (Event ID 4769) with weak encryption like RC4, and a single user requesting many service tickets for different SPNs. These patterns are detectable in Splunk ES through the Authentication data model and custom correlation searches.

Answer

Multiple failed logon attempts (Event ID 4625) for a single user account within a short period.

Answer

The use of the KRBTGT account to request a ticket-granting ticket (TGT) with a long lifetime.

Answer

A sudden increase in DNS queries for service records (SRV) from a single host.