SPLK-5001 Practice Test 14 — 15 Questions

Question 1

An analyst is investigating a potential pass-the-hash attack in Splunk ES. Which TWO of the following are indicators that should be reviewed in Windows Security event logs? (Choose two.)

Accepted Answer

Event Code 4624 with Logon Type 3 and NTLM authentication. Pass-the-hash attacks leverage stolen NTLM hashes to authenticate, often resulting in Event Code 4624 with Logon Type 3 and NTLM authentication, and Event Code 4776 for credential validation. These events, when correlated, can reveal lateral movement. Other event codes like 4672, 4768, and 5140 are not specific to pass-the-hash and may generate false positives. Focusing on NTLM-related events is crucial for accurate detection.

Answer

Event Code 4768 with Kerberos TGT request

Answer

Event Code 5140 with network share access

Answer

Event Code 4672 with SeDebugPrivilege assigned

Question 2

You are hunting for Kerberoasting activity in your Windows environment. You have Splunk ingesting Windows Security event logs. Which Event ID and field combination best supports identifying accounts requesting service tickets with weak encryption?

Accepted Answer

Event ID 4769 with TicketEncryptionType=0x17 and ServiceName not ending in $. Kerberoasting involves requesting Kerberos service tickets for accounts with SPNs and then cracking them offline. Event ID 4769 records these requests, and RC4 encryption type 0x17 is the weak cipher attackers prefer. Filtering out machine accounts ending in $ narrows results to user accounts, which are the realistic targets.

Answer

Event ID 4771 with FailureCode=0x18

Answer

Event ID 4768 with TicketOptions=0x40810010

Answer

Event ID 4624 with LogonType=3 and AccountName ending in $

Question 3

A security team at a financial institution is aligning its detection capabilities with the MITRE ATT&CK framework. They want to identify techniques related to the 'Credential Access' tactic. Which TWO of the following are MITRE ATT&CK techniques that belong to the Credential Access tactic? (Choose two.)

Accepted Answer

Brute Force. The MITRE ATT&CK Credential Access tactic includes techniques such as Brute Force (T1110) and Exploitation for Credential Access (T1212). These techniques are specifically aimed at stealing credentials, such as account names and passwords. Spearphishing Attachment, Process Discovery, and Registry Run Keys belong to other tactics like Initial Access, Discovery, and Persistence, respectively.

Answer

Registry Run Keys / Startup Folder

Answer

Spearphishing Attachment

Answer

Process Discovery

Question 4

During a proactive hunt for Kerberoasting in an Active Directory environment, you ingest Windows Security Event Code 4769 with the service ticket options field available as Ticket_Options. You want to isolate requests made with weak RC4 encryption rather than AES. Which Splunk search best surfaces these potentially malicious service ticket requests?

Accepted Answer

index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17 | stats count values(Service_Name) by Account_Name. Kerberoasting abuses Kerberos service ticket requests, which are recorded in Security Event Code 4769. Because the attack relies on extracting tickets encrypted with the weaker RC4-HMAC algorithm for offline cracking, filtering on the encryption type value 0x17 and aggregating by account and service name produces a focused list of candidate activity that an analyst can triage further.

Answer

index=wineventlog EventCode=4769 Ticket_Options=0x40810000 | stats count by Account_Name, Service_Name

Answer

index=wineventlog EventCode=4768 Ticket_Encryption_Type=0x17 | stats count by Account_Name, Service_Name

Answer

index=wineventlog EventCode=4769 | where Ticket_Options="AES256" | stats count by Account_Name

Question 5

You are a security analyst using Splunk Enterprise Security (ES) to map detections to the MITRE ATT&CK framework. Your CISO wants to understand which ATT&CK tactic is most directly addressed by the correlation search that detects suspicious PowerShell execution with encoded commands (T1059.001). Under which ATT&CK tactic should you classify this detection?

Accepted Answer

Execution. The detection of suspicious PowerShell execution with encoded commands directly aligns with the Execution tactic, as it signifies adversary-controlled code running on a system. MITRE ATT&CK technique T1059.001 is explicitly categorized under Execution, and Splunk ES uses this mapping to help analysts prioritize and contextualize alerts. Classifying it under other tactics would inaccurately reflect the adversary's current phase.

Answer

Persistence

Answer

Defense Evasion

Answer

Initial Access

Question 6

A security analyst needs to identify the percentage of total authentication events that each user account generated over the past week. The search must return the user, the count of events for that user, and the percentage each user represents of all authentication events, sorted so the largest share appears first. Which SPL search accomplishes this?

Accepted Answer

index=auth action=* | stats count BY user | eventstats sum(count) AS total | eval pct=round((count/total)*100,2) | sort - pct. The requirement is a per-row percentage against a grand total. stats collapses events into one row per user with a count, and eventstats sum(count) broadcasts the overall total onto every row so eval can divide each user's count by it. Sorting on the computed percentage descending satisfies the ordering requirement.

Answer

index=auth action=* | stats count BY user | eval pct=(count/sum(count))*100 | sort - pct

Answer

index=auth action=* | stats count BY user | addtotals | eval pct=(count/Total)*100 | sort - pct

Answer

index=auth action=* | top user | eval pct=(count/total)*100 | sort - pct

Question 7

A security operations center (SOC) is using Splunk Enterprise Security to align with the MITRE ATT&CK framework. The team wants to improve detection of techniques within the 'Credential Access' tactic. Which TWO of the following data sources are most critical to enable for detecting credential dumping techniques such as LSASS memory access? (Choose two.)

Accepted Answer

Sysmon Event Logs (e.g., Event ID 10: ProcessAccess). Detecting credential dumping techniques such as LSASS memory access requires endpoint-level visibility. Sysmon Event ID 10 logs process access to LSASS, and EDR telemetry provides detailed monitoring of memory access and API calls. Together, these data sources enable Splunk ES to identify and alert on credential dumping attempts. Windows Security Event Logs, PowerShell logs, and firewall logs, while valuable for other detections, do not provide the direct memory access visibility needed here.

Answer

Windows Security Event Logs (e.g., Event ID 4624, 4672)

Answer

Firewall logs

Answer

Windows PowerShell Operational Logs (e.g., Event ID 4104)

Question 8

A Splunk ES analyst is investigating an incident and needs to determine the potential impact of a compromised user account. The analyst wants to see all assets and identities associated with the user, including their roles and privileges, to assess lateral movement risks. Which Splunk ES feature should the analyst use?

Accepted Answer

Asset & Identity Framework. The Asset & Identity Framework is designed to manage and correlate asset and identity information, including user roles and privileges. When a user account is compromised, analysts can use this framework to view all associated assets and identities, understand the user's access level, and identify potential lateral movement paths. This directly supports impact assessment. Other features like Incident Review or Threat Intelligence may provide context but do not centralize identity and asset data.

Answer

Protocol Intelligence

Answer

Threat Intelligence Framework

Answer

Incident Review

Question 9

A security analyst needs to correlate two event types for the same user within a 10-minute window: a 'login' event and a subsequent 'privilege_escalation' event. The events share a common field 'user'. Which SPL command should be used to join these events based on the user and time proximity?

Accepted Answer

transaction user maxspan=10m. The transaction command is designed to group related events that share a common field and occur within a specified time span. By using maxspan=10m, it ensures that only login and privilege escalation events for the same user that happen within 10 minutes are combined into a single transaction. This provides the necessary temporal correlation, unlike join or stats which do not enforce time windows.

Answer

join user [search privilege_escalation]

Answer

stats values(action) as actions by user

Answer

append [search privilege_escalation] | selfjoin user

Question 10

A security team is aligning their Splunk ES deployment with the NIST Cybersecurity Framework (CSF) 'Respond' function. They want to ensure that their incident response capabilities are properly supported by Splunk ES features. Which TWO of the following Splunk ES features are most directly aligned with the 'Respond' function? (Choose two.)

Accepted Answer

Adaptive Response. The NIST CSF 'Respond' function focuses on taking action after a cybersecurity incident is detected. In Splunk ES, Incident Review provides a centralized workflow for triaging, assigning, and managing incidents, while Adaptive Response enables automated or manual response actions to mitigate threats. Together, these features directly support incident response activities. Other features like Threat Intelligence, Asset & Identity, and Protocol Intelligence enhance detection and investigation but are not primarily designed for executing response actions.

Answer

Threat Intelligence Framework

Answer

Asset & Identity Framework

Answer

Protocol Intelligence

Question 11

You are hunting for living-off-the-land binary (LOLBin) abuse on Windows endpoints. You have Sysmon EventCode 1 process creation logs. Which search best surfaces suspicious use of a signed Microsoft binary to download or execute remote content?

Accepted Answer

index=sysmon EventCode=1 | where match(CommandLine, "(?i)(certutil|bitsadmin|mshta|regsvr32).*(-urlcache|-transfer|-decode|http)") | table _time, Computer, User, Image, CommandLine. LOLBin abuse is identified by the combination of a legitimate signed binary and command-line switches that download or execute remote content. Matching patterns such as certutil -urlcache or bitsadmin -transfer against Sysmon process creation events isolates the technique and preserves the command-line context needed for analyst review, unlike frequency-based or parent-process approaches.

Answer

index=sysmon EventCode=1 | stats dc(Image) as distinct_binaries by Computer | where distinct_binaries > 50

Answer

index=sysmon EventCode=1 | search ParentImage="*\winword.exe" OR ParentImage="*\excel.exe" | stats count by Image

Answer

index=sysmon EventCode=1 | search Image="*\powershell.exe" | stats count by CommandLine | sort -count

Question 12

A security analyst is investigating a potential insider threat and needs to see the number of events per hour for a specific user over the past 48 hours. The events are in the 'index=insider' with a field 'user'. Which SPL search will produce a time chart showing hourly event counts for that user?

Accepted Answer

index=insider user=john.doe | timechart span=1h count. The timechart command is specifically designed to create time-series charts, and with span=1h it buckets events into hourly intervals. Filtering by the user ensures only that user's events are counted, resulting in the desired hourly event count chart.

Answer

index=insider user=john.doe | stats count by date_hour

Answer

index=insider user=john.doe | chart count over _time by user

Answer

index=insider user=john.doe | bucket _time span=1h | stats count by _time

Question 13

A security analyst is writing SPL searches to detect suspicious activity and wants to understand which commands can be used to filter or transform search results. Which TWO of the following statements about SPL commands are accurate? (Choose two.)

Accepted Answer

The stats command can calculate aggregate statistics such as count, sum, and average, grouped by one or more fields.. The where command filters using eval expressions and can reference computed fields, while the stats command aggregates metrics grouped by fields. Both are fundamental SPL commands for filtering and transforming results. The other statements misrepresent search placement, the non-destructive nature of table, and the raw-text extraction capability of rex.

Answer

The rex command can only extract fields from indexed fields, not from the raw event text.

Answer

The table command permanently removes all fields not listed from the search results, affecting subsequent commands.

Answer

The search command can only be used as the first command in a search pipeline.

Question 14

A security analyst needs to create a search that identifies users who have logged in from more than three distinct countries within the last 24 hours, which could indicate compromised credentials. The authentication logs contain 'user' and 'src_country' fields. Which SPL search correctly identifies these users?

Accepted Answer

index=auth earliest=-24h | stats dc(src_country) as country_count by user | where country_count>3. The correct search uses a time filter to limit events to the last 24 hours and then employs stats with dc(src_country) to count distinct countries per user. The where clause filters for counts greater than three. This approach is efficient and directly addresses the requirement, avoiding the pitfalls of including historical data or counting duplicate country entries.

Answer

index=auth earliest=-24h | transaction user | where mvcount(src_country)>3

Answer

index=auth | stats dc(src_country) as country_count by user | where country_count>3

Answer

index=auth earliest=-24h | stats values(src_country) as countries by user | where mvcount(countries)>3

Question 15

What is the purpose of the 'Investigation Workbench' in Splunk ES?

Accepted Answer

To provide a unified view of incident artifacts.. The Investigation Workbench in Splunk Enterprise Security provides analysts with a unified, single-pane view of all artifacts related to an incident — events, risk scores, assets, identities, and related notables — so they can pivot and correlate without jumping between dashboards. It aggregates context from multiple sources into one investigative surface. This is distinct from administrative or configuration functions.

Answer

To run administrative index maintenance.

Answer

To manage user identities.

Answer

To configure correlation searches.