SPLK-5001 Practice Test 16 — 15 Questions

Question 1

Which TWO commands require a grouping field to function correctly?

Accepted Answer

transaction. Stats and transaction require a grouping field.

Answer

eval

Answer

search

Answer

rename

Question 2

You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?

Accepted Answer

Subsearches are limited by the 'maxout' configuration and execution time.. Subsearches have a limit on the number of results returned (default 10,000) and a time limit.

Answer

Subsearches only return the first 10 results.

Answer

Subsearches cannot use the 'stats' command.

Answer

Subsearches cannot reference fields from the outer search.

Answer

Subsearches always run after the outer search completes.

Question 3

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

Accepted Answer

Incident Review. The Incident Review dashboard is the primary interface for SOC analysts to manage active notable events.

Answer

Threat Intelligence

Answer

Security Posture

Answer

User Activity

Question 4

Which TWO of the following are examples of reconnaissance techniques used by attackers?

Accepted Answer

Domain footprinting. Port scanning and domain footprinting are common reconnaissance activities.

Answer

Password cracking

Answer

Log file deletion

Answer

Data encryption

Question 5

You are using 'lookup' to add user info. What happens if the common field doesn't exist in the lookup file?

Accepted Answer

The events without a match are left with null values in the lookup fields.. The lookup command leaves the output fields null for those events.

Answer

The lookup file is renamed.

Answer

The events without a match are deleted.

Answer

The entire search fails.

Question 6

Which THREE commands are used to manipulate multi-value fields?

Accepted Answer

mvcombine. Mvexpand, mvcombine, and mvfilter are used for MV fields.

Answer

rename

Answer

table

Question 7

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

Accepted Answer

Configure > Threat Intelligence > Threat Sources. The Threat Intelligence Uploads page or Data Sources page within the Threat Intelligence framework confirms connectivity.

Answer

Configure > Data Inputs

Answer

Dashboard > Threat Intelligence

Answer

Configure > Content Management

Question 8

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

Accepted Answer

Correlation Search Editor. The Correlation Search editor allows users to define custom search logic against threat intelligence lists.

Answer

Notable Event Suppressor

Answer

Risk Analysis Configuration

Answer

Threat Intelligence Framework

Question 9

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

Accepted Answer

Correlation Search Editor. The 'Correlation Search' settings allow for modifying the risk score assigned to notable events.

Answer

Notable Event Settings

Answer

Incident Review

Answer

Risk Analysis Dashboard

Question 10

Which TWO commands provide information about the fields present in the events?

Accepted Answer

fields. Fields and table can show which fields exist.

Answer

lookup

Answer

eval

Answer

sort

Question 11

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

Accepted Answer

Network Traffic. The Network Traffic data model contains information about network connections, including source/destination IP, port, and protocol.

Answer

Authentication

Answer

Change Analysis

Answer

Endpoint

Question 12

Which THREE of the following are valid ways to filter events based on time?

Accepted Answer

earliest=, latest=. Earliest/latest, relative time modifiers, and 'where' with _time are valid.

Answer

stats _time

Answer

bin _time

Question 13

You are conducting a hunt for unauthorized remote access tools. Which Splunk command is most effective for identifying processes that are running from unusual directories (e.g., AppData, Temp)?

Accepted Answer

index=windows | stats count by Image | where like(Image, "%\AppData%"). Filtering by 'Image' and using 'where' to identify paths containing 'AppData' or 'Temp' is a standard way to find suspicious persistence.

Answer

index=windows | table Image | sort Image

Answer

index=windows | search Image="*" | head 100

Answer

index=windows | rare Image

Question 14

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

Accepted Answer

Risk Analysis. Risk-Based Alerting (RBA) or Risk Analysis allows for aggregating risk scores over time for entities.

Answer

Notable Event Aggregation

Answer

Asset Investigator

Answer

Threat Activity

Question 15

An attacker has cleared the Windows Event Logs to hide their tracks. You are hunting for this activity. Which Event ID in the System log indicates that the log service was stopped or cleared?

Accepted Answer

Event ID 1102. Event ID 1102 is the specific Windows event logged when the Security audit log is cleared.

Answer

Event ID 4688

Answer

Event ID 7036

Answer

Event ID 4624