SPLK-5001 Practice Test 16 — 15 Questions

Question 1

Which THREE of the following are valid ways to filter events based on time?

Accepted Answer

earliest=, latest=. Option B (earliest=, latest=) is correct because these are the standard time-range arguments accepted by the search command to constrain events to a specific time window. Option D (index=logs earliest=-1h latest=now) is correct because it applies those earliest/latest time modifiers directly in a search, filtering events to the last hour up to the current time. Option E (where _time > relative_time(now(), "-24h")) is correct because the where command evaluates a boolean expression on the _time field, using relative_time to compute a 24-hour-ago timestamp and filtering events newer than it. Option A (stats _time) is not a filtering method; stats is an aggregation command and _time alone does not restrict events by time. Option C (bin _time) is also not a filter; bin buckets timestamps into discrete intervals for grouping or charting rather than excluding events outside a time range.

Answer

stats _time

Answer

bin _time

Question 2

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

Accepted Answer

Suspicious URL in email body. Option A (Suspicious URL in email body) is correct because phishing emails typically contain links to spoofed or malicious domains designed to harvest credentials or deliver malware, and these URLs are visible in email gateway or mail server logs as embedded hyperlinks that can be inspected for mismatched display text, URL shorteners, or known-bad domains. Option E (Unexpected sender domain) is correct because phishing often originates from look-alike or typosquatted domains (e.g., micros0ft.com) or compromised legitimate accounts, and analyzing the envelope sender and From header domains in email logs reveals these anomalies through SPF, DKIM, and DMARC failures. Option B (Successful authentication) is not a phishing indicator; it is a normal event that could occur after a user is tricked, but by itself it does not indicate phishing. Option C (High CPU usage on server) relates to resource consumption or malware/DoS activity, not to email-based phishing indicators. Option D (Unusual printer activity) is unrelated to phishing and would more likely indicate insider activity or a print server issue.

Answer

Successful authentication

Answer

High CPU usage on server

Answer

Unusual printer activity

Question 3

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

Accepted Answer

Change the notable event status. Option A is correct because the Incident Review dashboard in Splunk Enterprise Security lets analysts change a notable event's status (e.g., New, In Progress, Resolved, Closed) directly from the event's row or detail view to reflect triage progress. Option B is correct because the dashboard provides the ability to run adaptive response actions (such as sending email, running a script, or triggering other configured actions) on a notable event without leaving the review workflow. Option C is not correct because correlation search code is edited in the Correlation Search editor or via configuration files, not from the Incident Review dashboard. Option D is not correct because rebuilding the threat intelligence index is an administrative maintenance task performed through threat intelligence management, not an incident review action. Option E is not correct because deleting an underlying index is a destructive administrative operation done in Settings, not from the Incident Review dashboard.

Answer

Modify the correlation search code

Answer

Rebuild the threat intelligence index

Answer

Delete the underlying index

Question 4

Which TWO of the following are common types of social engineering?

Accepted Answer

Pretexting. Pretexting (C) is a common social engineering technique in which an attacker invents a fabricated scenario or identity to manipulate a victim into divulging information or performing an action, exploiting human trust rather than technical flaws. Phishing (D) is likewise a core social engineering method, using fraudulent emails, messages, or websites to trick users into revealing credentials or clicking malicious links. Both rely on psychological manipulation of people, which is the defining characteristic of social engineering. By contrast, buffer overflow (A) and SQL injection (B) are technical software exploitation attacks against memory handling and database input validation respectively, and port scanning (E) is a network reconnaissance technique for discovering open TCP/UDP services — none of these target human behavior, so they are not social engineering types.

Answer

Buffer Overflow

Answer

SQL Injection

Answer

Port Scanning

Question 5

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

Accepted Answer

Using the 'lookup' command against a KV Store collection.. Option A is correct because Splunk ES supports enriching events with threat intelligence through the SPL 'lookup' command, which can match event fields against a KV Store collection (such as a threat intel lookup) to append context like threat matches or risk scores. Option D is correct because the Threat Intelligence Manager in Splunk ES is the built-in interface for configuring and managing threat intelligence feeds, which download and normalize indicators that are then used to enrich events via lookups. Option B is incorrect because changing a user's password is an authentication/account action and has no role in threat intelligence enrichment. Option C is incorrect because editing indexer configuration files is not a supported or practical method for enriching events with threat intelligence in Splunk ES. Option E is incorrect because deleting old notable events is a data retention/cleanup action and does not add threat intelligence context to events.

Answer

By changing the user's password.

Answer

By editing the indexer's configuration files.

Answer

By deleting the old notable events.

Question 6

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

Accepted Answer

Improved focus on behavioral indicators. Option A is correct because RBA shifts detection from individual notable events to behavioral indicators, aggregating related events into risk attributions on entities (users, systems) so analysts can spot patterns of behavior rather than isolated signatures. Option B is correct because RBA assigns risk scores to entities via risk rules and risk factors, allowing threats to be prioritized by accumulated entity risk rather than by raw event severity. Option E is correct because RBA consolidates many low-fidelity or individually insignificant events into a smaller set of high-risk entities, thereby reducing alert noise and analyst fatigue. Option C is not correct because RBA is a detection and prioritization framework; Splunk ES does not automatically remediate threats, which requires separate orchestration tools such as Splunk SOAR. Option D is not correct because license management is handled by the Splunk license manager and is unrelated to RBA's risk scoring and alerting capabilities.

Answer

Automatic remediation of threats

Answer

Automatic license management

Question 7

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

Accepted Answer

Detect. The NIST Cybersecurity Framework (CSF) Core defines five concurrent and continuous functions: Identify, Protect, Detect, Respond, and Recover. Option E (Identify) is correct because it covers understanding the organization's assets, risks, and governance to prioritize cybersecurity efforts. Option D (Protect) is correct because it encompasses safeguards such as access control, awareness training, and data security to limit or contain the impact of a potential event. Option C (Detect) is correct because it defines activities to identify the occurrence of a cybersecurity event, including continuous monitoring and anomaly detection. Options A (Report) and B (Eradicate) are not CSF Core functions; they belong to other frameworks or incident-response lifecycles (for example, 'Eradicate' appears in NIST SP 800-61 incident handling, and 'Report' is not one of the five CSF functions).

Answer

Report

Answer

Eradicate

Question 8

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

Accepted Answer

Domain Names. The Splunk Enterprise Security Threat Intelligence framework organizes indicators into specific intelligence types that can be uploaded, matched against events, and used in correlation searches. Option B (Domain Names) is correct because domain indicators are a supported threat intelligence type, typically stored in the 'domains' intelligence type and used to detect DNS-based malicious activity. Option D (IP Addresses) is correct because IP addresses are a core supported type, stored as the 'ip_intel' intelligence type and used to match network traffic against known malicious hosts. Option E (File Hashes) is correct because file hash indicators (such as MD5, SHA-1, and SHA-256) are supported as the 'file_intel' intelligence type for detecting known malicious files. Option A (User Session Tokens) is not a threat intelligence category in the framework; session tokens are authentication artifacts, not indicators of compromise. Option C (Network Topology Maps) is not a threat intelligence category either; topology maps are network documentation, not actionable threat indicators.

Answer

User Session Tokens

Answer

Network Topology Maps

Question 9

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

Accepted Answer

Notable Events framework.. The NIST CSF 'Detect' function requires capabilities to identify the occurrence of cybersecurity events, and in Splunk ES the Notable Events framework (A) is the mechanism that surfaces and tracks those identified events as discrete, reviewable notables for analysts, directly supporting detection visibility. Correlation Searches (D) are the scheduled or real-time detections that evaluate data against rules and generate those notable events, making them the core detection logic that fulfills the Detect function. Workload Management (B) is a resource-scheduling and CPU/IO prioritization feature, not a detection-visibility capability. Data Model acceleration (C) and Report acceleration (E) are performance optimizations that speed up searches over data models or saved reports, but they do not themselves provide detection visibility or generate security findings.

Answer

Workload Management.

Answer

Data Model acceleration.

Answer

Report acceleration.

Question 10

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Accepted Answer

Reconnaissance. The Cyber Kill Chain, developed by Lockheed Martin, defines seven sequential phases of an intrusion: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Option B (Reconnaissance) is correct because it is the first phase, where the attacker gathers information about the target (e.g., via OSINT, scanning, or social engineering). Option C (Weaponization) is correct because it is the phase where the attacker pairs a remote access trojan or exploit with a deliverable payload (e.g., a malicious document or exploit kit). Option D (Exploitation) is correct because it is the phase where the malicious code is triggered to take advantage of a vulnerability on the target system. Option A (Containment) is not part of the Cyber Kill Chain; it belongs to incident response frameworks such as NIST SP 800-61 (containment, eradication, recovery). Option E (Patching) is not a kill chain phase either; it is a defensive remediation activity, not an attacker phase in the model.

Answer

Containment

Answer

Patching

Question 11

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

Accepted Answer

Using 'NOT' clauses to exclude known administrative processes. Option B is correct because adding 'NOT' clauses to a search (e.g., NOT process_name=svchost.exe) filters out known administrative or benign processes, directly suppressing events that would otherwise generate false positives during a hunt. Option D is correct because lookup tables let you maintain an external list of known-good baselines (IPs, hashes, accounts) and exclude them via lookup-based filtering, which is a standard Splunk method for whitelisting trusted activity. Option E is correct because the 'rare' command's threshold parameter controls how infrequently a value must occur to be reported; raising or tuning that threshold prevents low-frequency but legitimate events from being flagged as suspicious. Option A is wrong because deleting raw logs after indexing destroys forensic evidence and is not a noise-reduction technique. Option C is wrong because increasing the search time range expands the data examined and typically increases, not reduces, false positives.

Answer

Deleting raw logs after indexing

Answer

Increasing the search time range

Question 12

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Accepted Answer

Enablement of the 'Splunk App for CIS Benchmarks'.. Option B is correct because the Splunk App for CIS Benchmarks provides the pre-built dashboards, reports, and knowledge objects that map CIS Benchmark controls to Splunk data, which is required to report on Secure Configuration compliance. Option D is correct because the Splunk Universal Forwarder must be deployed on the target endpoints to collect and forward the relevant security configuration data (such as registry, file, and audit settings) to the Splunk indexers for analysis. Option A is incorrect because Splunk can ingest data via multiple protocols (Splunk-to-Splunk, HTTP Event Collector, syslog, etc.), and restricting to syslog only is neither necessary nor sufficient for CIS Benchmark reporting. Option C is incorrect because a third-party antivirus solution is unrelated to Splunk's CIS Benchmark reporting capability. Option E is incorrect because index storage tiering (Hot/Warm) affects retention and performance, not the ability to report on Secure Configuration.

Answer

Configure all logs to use the 'Syslog' protocol only.

Answer

Install a third-party antivirus solution.

Answer

Configure the index to 'Hot/Warm' storage only.

Question 13

Which TWO factors are critical for effective Asset and Identity enrichment?

Accepted Answer

The consistency of the source data files.. Effective Asset and Identity enrichment in Splunk Enterprise Security depends on the quality and reliability of the lookup data being ingested, so option B is correct: the consistency of the source data files (e.g., stable CSV schemas, uniform field names, and regularly refreshed asset/identity lookups) ensures that the correlation searches and lookups resolve correctly. Option E is also correct because the enrichment framework relies on correct matching logic — for example, matching an event's src/dest IP against the asset lookup's ip field or matching a user against the identity lookup's user field — since incorrect or ambiguous match fields (such as overlapping CIDR ranges or case-sensitive usernames) will produce wrong or missing enrichments. Option A is not critical because the physical location of the indexer does not affect lookup matching or data consistency. Option C is irrelevant since dashboard color choices are purely cosmetic. Option D is not critical because the OS version of the search head does not determine the correctness of asset and identity correlation.

Answer

The physical location of the Splunk indexer.

Answer

The number of colors used in the dashboard.

Answer

The version of the OS running on the search head.

Question 14

A threat hunter wants to enrich firewall events with asset ownership data stored in a CSV lookup named asset_owners.csv, which maps dest_ip to owner and department. The lookup is already defined in transforms.conf. The hunter needs the owner and department fields added to each event. Which SPL search accomplishes this?

Accepted Answer

index=firewall | lookup asset_owners.csv dest_ip OUTPUT owner, department. Field enrichment from a lookup table is performed with the lookup command, which matches a key field in the events to the lookup's key and adds specified output fields. Referencing the CSV filename works when the lookup is defined in transforms.conf, and the OUTPUT clause limits the added fields to owner and department. This is the standard, efficient method for enriching events with asset ownership data.

Answer

index=firewall | append [| inputlookup asset_owners.csv] | stats values(owner) by dest_ip

Answer

index=firewall | eval owner = asset_owners(dest_ip) | eval department = asset_owners(dest_ip)

Answer

index=firewall | inputlookup asset_owners.csv | join dest_ip

Question 15

A risk analyst notices that a particular risk rule is generating an excessive number of risk events for low-severity activities, causing alert fatigue. The analyst wants to reduce the impact of this rule on overall risk scores without disabling it entirely. What is the most appropriate action?

Accepted Answer

Modify the risk rule's risk score value to a lower number in the risk rule configuration.. Lowering the risk score value in the risk rule configuration directly reduces the rule's contribution to risk scores, mitigating alert fatigue while preserving detection. Other options either do not affect risk scoring or remove visibility entirely. This is the precise method for tuning risk-based alerting.

Answer

Disable the risk rule temporarily and monitor the impact.

Answer

Change the risk index retention period to reduce storage consumption.

Answer

Add a throttle to the correlation search to limit the number of alerts per hour.