SPLK-5001 Practice Test 14 — 15 Questions

Question 1

When dealing with multi-value fields, which command allows you to break them into individual events?

Accepted Answer

mvexpand field_name. The 'mvexpand' command expands a multi-value field into separate events.

Answer

expand field_name

Answer

mv_to_events field_name

Answer

split field_name

Question 2

A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?

Accepted Answer

Threat Intelligence. Threat Intelligence provides the infrastructure to ingest and correlate malicious URLs from phishing campaigns.

Answer

Incident Review

Answer

Audit Trails

Answer

Content Management

Question 3

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

Accepted Answer

Endpoint. The Endpoint data model captures process command-line arguments where PowerShell activity resides.

Answer

Network Sessions

Answer

Web

Answer

Authentication

Question 4

You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?

Accepted Answer

Geographic Information. The 'Geographic Information' dashboard in Splunk ES maps IP addresses to geographic locations.

Answer

Protocol Intelligence

Answer

Threat Intelligence

Answer

User Activity

Question 5

An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?

Accepted Answer

Endpoint. The Endpoint data model captures process execution, which is the primary indicator of living-off-the-land techniques.

Answer

Network Traffic

Answer

Authentication

Answer

Change Analysis

Question 6

Which THREE of the following fields are required for mapping data to the 'Authentication' CIM data model?

Accepted Answer

status. The Authentication data model requires the user, the status (success/failure), and the action taken.

Answer

dest_port

Answer

file_name

Question 7

Which command allows you to limit the number of fields displayed in your final results table?

Accepted Answer

fields + src_ip, dest_ip. The 'fields' command is used to include or exclude fields from the event display.

Answer

table src_ip, dest_ip

Answer

select src_ip, dest_ip

Answer

show src_ip, dest_ip

Question 8

You want to calculate the standard deviation of 'response_time' per 'server'. Which command is correct?

Accepted Answer

stats stdev(response_time) as std_dev by server. The 'stdev' function is used within the stats command.

Answer

stats variance(response_time) as std_dev by server

Answer

stats sigma(response_time) by server

Answer

stats dev(response_time) by server

Question 9

Which TWO commands are helpful for identifying specific patterns in data?

Accepted Answer

transaction. Cluster and transaction help identify event patterns.

Answer

rename

Answer

sort

Answer

head

Question 10

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

Accepted Answer

Change Analysis. The Change Analysis data model tracks configuration and policy changes within the environment.

Answer

Network Traffic

Answer

Endpoint

Answer

Authentication

Question 11

An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?

Accepted Answer

4624. Event ID 4624 with Logon Type 3 (Network) or 9 (NewCredentials) is often associated with pass-the-hash attacks.

Answer

4720

Answer

4625

Answer

4740

Question 12

You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?

Accepted Answer

tstats. Using 'tstats' on the Network Traffic data model with 'count' grouped by time is the most efficient way to detect volume anomalies.

Answer

inputlookup

Answer

map

Answer

search

Question 13

A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?

Accepted Answer

User Activity. The User Activity dashboard or the Authentication data model is designed to show user-specific login trends.

Answer

Threat Intelligence

Answer

Asset Investigator

Answer

Incident Review

Question 14

Which THREE of the following components are part of the 'Endpoint' data model?

Accepted Answer

Processes. The Endpoint data model encompasses file activity, process execution, and registry changes.

Answer

Network connections

Answer

HTTP Requests

Question 15

You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?

Accepted Answer

EventCode 10. Sysmon Event ID 10 captures ProcessAccess, which is the standard event logged when a process like a credential dumper accesses the memory of lsass.exe.

Answer

EventCode 1

Answer

EventCode 11

Answer

EventCode 3