SPLK-5001 Practice Test 15 — 15 Questions

Question 1

You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?

Accepted Answer

Create a Notable Event Suppression entry.. Notable Event Suppression entries in Splunk ES allow you to filter out specific notable events from triggering alerts or appearing in the Incident Review dashboard based on field values (e.g., matching a vulnerability scanner's signature or source). This is the most precise method because it targets only the specific events you want to suppress while leaving the correlation search fully operational for all other detections.

Answer

Lower the urgency of the notable event.

Answer

Modify the correlation search cron schedule.

Answer

Delete the scan data from the index.

Question 2

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

Accepted Answer

eval decoded=base64_decode(field). The eval command with base64_decode function (A) is the correct SPL function to decode a Base64-encoded string. It takes a field containing Base64 data and returns the decoded string, which can then be analyzed.

Answer

rex field=field "(?<decoded>.*)"

Answer

transform base64 field

Answer

eval decoded=decode(field, "base64")

Question 3

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

Accepted Answer

Risk Data Model. The Risk Analysis adaptive response action enriches events by writing risk events to the risk index using the Risk Data Model, which defines risk objects, risk scores, and risk annotations. The action populates fields like risk_object, risk_object_type, risk_score, and risk_message, all of which are structured by the Risk Data Model. This model is what the Risk Framework uses to aggregate and display risk.

Answer

Vulnerability Data Model

Answer

Threat Intelligence Data Model

Answer

Endpoint Data Model

Question 4

Which THREE tasks are performed within the 'CIM Setup' interface?

Accepted Answer

Mapping sourcetypes to data models.. In the Splunk Common Information Model (CIM) Setup interface, the three core tasks are mapping sourcetypes to data models (B), enabling data model acceleration (C), and verifying mapping compliance (D). Option B is correct because CIM Setup lets you associate event sourcetypes with the appropriate CIM data models so that fields are normalized for apps like Enterprise Security. Option C is correct because the same interface provides checkboxes to enable acceleration on each data model, which builds the summary data needed for fast correlation searches. Option D is correct because CIM Setup includes a validation/verification step that checks whether the mapped sourcetypes actually populate the required CIM fields and flags any compliance gaps. Option A is not part of CIM Setup; index retention policies are configured in indexes.conf or the Indexes settings, not in the CIM Setup UI. Option E is also not part of CIM Setup; user roles and permissions are managed through Splunk authentication and authorization (e.g., Settings > Roles or authorize.conf).

Answer

Configuring index retention policies.

Answer

Defining user roles and permissions.

Question 5

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

Accepted Answer

Risk Analysis Dashboard. The Risk Analysis Dashboard in Splunk Enterprise Security is purpose-built to visualize risk scores and the underlying risk events that contributed to them. It shows a timeline of risk events per entity (user, system, etc.), letting the analyst trace exactly which detections drove the score spike.

Answer

Security Posture Dashboard

Answer

Investigation Workbench

Answer

Incident Review

Question 6

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

Accepted Answer

Command and Control (C2).. Strict egress filtering on the firewall blocks outbound connections from compromised hosts to attacker-controlled infrastructure, which directly disrupts the Command and Control (C2) phase of the Cyber Kill Chain. Without C2, the attacker cannot issue commands, exfiltrate data, or maintain persistence, making egress filtering one of the most effective C2 mitigations.

Answer

Installation.

Answer

Reconnaissance.

Answer

Exploitation.

Question 7

Which THREE of the following are valid search operators?

Accepted Answer

OR. The three valid search operators here are OR (B), AND (C), and NOT (E). OR (B) is a Boolean operator that broadens a query by returning results matching either term, e.g., 'cat OR dog'. AND (C) is a Boolean operator that narrows a query by requiring both terms to be present, e.g., 'cat AND dog'. NOT (E) is a Boolean operator that excludes a term from results, e.g., 'cat NOT dog'. The remaining options are not search operators: WITH (A) is not a standard Boolean search operator, and BUT (D) is an ordinary English conjunction with no defined role in search query syntax.

Answer

WITH

Answer

BUT

Question 8

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

Accepted Answer

Access Anomalies. The Access Anomalies dashboard in Splunk Enterprise Security is designed to surface unusual authentication behavior, including spikes in failed logins followed by successful logins from new or unusual IP addresses — the classic signature of a brute-force attack. It aggregates authentication data and highlights anomalies in access patterns, making it the correct dashboard for this investigation.

Answer

User Activity Center

Answer

Protocol Intelligence

Answer

Threat Intelligence Activity

Question 9

Which TWO actions should be performed during the 'Data Preparation' phase of a threat hunt to ensure accurate results?

Accepted Answer

Mapping data sources to the Splunk Common Information Model (CIM). Option A is correct because mapping data sources to the Splunk Common Information Model (CIM) normalizes fields and event types (e.g., src, dest, user, action) across heterogeneous sources, so searches and correlation rules return consistent, accurate results during the hunt. Option D is correct because verifying data availability for the required time range confirms that the relevant indexes, sourcetypes, and retention policies actually contain the events covering the hunt's window, preventing false negatives caused by missing or aged-out data. Together, these two actions ensure the data is both semantically aligned and temporally complete before analysis begins. Option B is not part of Data Preparation; applying machine learning models belongs to later analysis or detection phases. Option C is unrelated, as creating user accounts is an administrative access task, not a data preparation step. Option E is incorrect because drafting the final incident report occurs at the conclusion of the hunt, after findings have been validated.

Answer

Applying machine learning models

Answer

Creating new user accounts

Answer

Drafting the final incident report

Question 10

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

Accepted Answer

Severity. In the 'Incident Review' dashboard's 'Notable Event' list, the tracked metrics include Severity (option A), which indicates the priority or impact level assigned to each notable event, and Status (option D), which reflects the current state of the event such as open, acknowledged, or closed. These two fields are standard columns in the notable events table because they help analysts triage and manage incidents efficiently. Raw file path (option B) is not a metric shown in that list; it pertains to file-level details elsewhere. Cluster replication factor (option C) is a storage or indexer configuration setting, not an incident metric. License expiration date (option E) is an administrative licensing detail, unrelated to the notable event list.

Answer

Raw file path

Answer

Cluster replication factor

Answer

License expiration date

Question 11

Which THREE commands can be used to handle or create statistical summaries?

Accepted Answer

stats. Option A, `stats`, is correct because it is the primary Splunk search command for calculating aggregate statistical summaries such as count, sum, avg, min, max, and dc over result sets. Option C, `streamstats`, is correct because it computes running (cumulative) statistics as events stream through the pipeline, producing statistical summaries like running totals and moving averages. Option D, `eventstats`, is correct because it enriches each event with aggregated statistics (for example, adding an avg or count field to every event) while preserving the original events, making it a statistical summary command. Option B, `fields`, is not correct because it only includes or excludes fields from results and does not compute any statistics. Option E, `sort`, is not correct because it merely orders results by specified fields and performs no statistical aggregation.

Answer

fields

Answer

sort

Question 12

Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?

Accepted Answer

Submit the hash to an external sandbox/reputation service. Option A is correct because submitting a file hash to an external sandbox or reputation service (e.g., VirusTotal, Hybrid Analysis) provides independent, multi-engine verdicts on whether that hash is known malicious, which is a standard validation step in Splunk ES investigations. Option B is correct because Splunk ES's Threat Intelligence framework lets you match the hash against configured threat intel sources and local intelligence stores, so a hit confirms the hash is associated with known malicious activity. Options C, D, and E are incorrect because restarting an endpoint, renaming a file, or changing its extension are remediation or evasion actions that do not verify whether the hash itself is malicious and provide no threat intelligence verdict.

Answer

Restart the endpoint

Answer

Rename the file

Answer

Change the file extension

Question 13

Which THREE pieces of information are commonly found in a Splunk ES Case?

Accepted Answer

Investigation metadata (status, owner). Option A is correct because a Splunk ES Case stores investigation metadata such as status (e.g., New, In Progress, Closed) and owner (the assigned analyst), which drive case workflow and accountability. Option B is correct because analysts add comments and notes to a case to document findings, hypotheses, and actions taken during the investigation. Option D is correct because Notable Events are the primary artifacts attached to a case, linking the correlated detections that triggered the investigation to the case record. Option C is not correct because raw indexer performance logs (e.g., splunkd.log, metrics.log) are infrastructure/diagnostic data, not case content. Option E is not correct because system health metrics belong to monitoring tools like the Monitoring Console, not to an ES Case.

Answer

Raw indexer performance logs

Answer

System health metrics

Question 14

Which TWO commands are helpful for identifying specific patterns in data?

Accepted Answer

transaction. The transaction command (D) is correct because it groups events that share a common value (such as a session ID or transaction ID) into a single event, letting you identify patterns across related events rather than viewing them in isolation. The cluster command (E) is correct because it uses pattern recognition to group together similar events that share common text or field values, which directly surfaces recurring patterns in the data. The rename command (A) only changes the name of a field and does not reveal patterns, while sort (B) merely orders results and head (C) only limits output to the first N results, so neither performs pattern identification.

Answer

rename

Answer

sort

Answer

head

Question 15

Which TWO of the following are key components of a successful incident investigation workflow in Splunk ES?

Accepted Answer

Case documentation and updates. In Splunk Enterprise Security, a successful incident investigation workflow begins with notable event triage (E), where analysts review and prioritize notable events generated by correlation searches, assign urgency, status, and ownership, and decide whether to escalate to a full investigation. Case documentation and updates (B) are equally essential, since Splunk ES uses the Investigation workbench and case management to record findings, attach evidence, add comments, and track status so the investigation is auditable and shareable across the SOC team. Automated index deletion (A) is not part of investigation workflow and would destroy forensic evidence, while user password resets (C) are an identity/response action, not an investigation component. Manual correlation search coding (D) is a detection-engineering task for creating or tuning correlation searches, not a key component of the investigation workflow itself.

Answer

Automated index deletion

Answer

User password resets

Answer

Manual correlation search coding