SPLK-5001 Practice Test 17 — 15 Questions

Question 1

A SOC manager wants to measure the effectiveness of detection coverage against the MITRE ATT&CK framework using Splunk Enterprise Security. The manager needs to visualize which tactics have the most and least coverage based on enabled correlation searches. Which Splunk ES feature should be used to generate this coverage map?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MITRE ATT&CK Dashboard. The MITRE ATT&CK Dashboard in Splunk ES is designed to map correlation searches to ATT&CK techniques and display coverage across the matrix. It allows managers to quickly see which tactics and techniques are covered and which are not, enabling informed decisions about detection engineering priorities. This aligns with the goal of measuring detection effectiveness against the framework.

Answer

Risk Analysis Framework

Answer

Threat Intelligence Management

Answer

Asset and Identity Framework

Question 2

An analyst observes a series of events where a process creates a child process with a command line that includes encoded PowerShell commands. The parent process is a Microsoft Office application. Which attack technique is most likely being used?

Accepted Answer

Phishing with a malicious macro. The scenario describes a Microsoft Office application spawning a child process with encoded PowerShell commands. This is a classic sign of a malicious macro, often delivered via phishing. Drive-by downloads, watering hole attacks, and supply chain compromises do not typically exhibit this specific process lineage. Therefore, the most likely technique is a phishing attack using a malicious macro.

Answer

Watering hole attack

Answer

Supply chain compromise

Answer

Drive-by download

Question 3

A Splunk ES analyst is investigating an alert for a suspicious PowerShell script execution. The alert is mapped to MITRE ATT&CK technique T1059.001 (PowerShell). To gather more context, the analyst wants to search for related events across multiple data sources. Which Splunk ES feature should they use to pivot from the alert to relevant events?

Accepted Answer

Incident Review. Incident Review is the Splunk ES feature that allows analysts to examine notables and pivot to associated events. It provides a drill-down capability to view raw events, asset context, and threat intelligence, enabling comprehensive investigation of an alert. Other features like Threat Intelligence Framework, Asset and Identity Framework, and Protocol Intelligence serve different purposes and do not provide the same pivot functionality.

Answer

Asset and Identity Framework

Answer

Threat Intelligence Framework

Answer

Protocol Intelligence

Question 4

A security analyst is investigating a notable in Splunk ES and needs to determine the potential impact of the threat. The analyst wants to correlate the risk object with asset and identity data to understand the criticality of the affected system and the user's role. Which two actions should the analyst take to enrich the investigation with asset and identity context? (Choose two.)

Accepted Answer

Use the Identity Investigator to review the user's role and watchlist status.. To enrich an investigation with asset and identity context, the analyst should use the Asset Investigator to assess system criticality and the Identity Investigator to understand the user's role and watchlist status. These tools pull from the asset and identity lookups, providing immediate context. Searching the risk index or raw events for this information is ineffective because that data is not stored there.

Answer

Run a search against the identity index to find the user's manager and department.

Answer

Use the 'inputlookup' command to query the risk index for asset information.

Answer

Configure a new correlation search to extract asset priority from the notable's raw event.

Question 5

What is the purpose of the 'head' command?

Accepted Answer

Return the first N results.. The 'head' command in Splunk returns the first N results from a search, where N is specified as an argument (default 10). It is commonly used to limit the number of results for quick inspection or to reduce processing in a pipeline.

Answer

Return the last N results.

Answer

Sort the results.

Answer

Count the results.

Question 6

You are hunting for evidence that an adversary is using scheduled tasks to maintain persistence on Windows endpoints. Which TWO data sources or artifacts should you prioritize reviewing in Splunk for this hunt? (Choose two.)

Accepted Answer

Windows Security Event ID 4698, which records that a scheduled task was created. Scheduled-task persistence leaves two complementary traces: the Security log records task creation as Event ID 4698, while Sysmon process creation captures the schtasks.exe command line with its arguments and parent process. Combining them lets an analyst confirm that a task was registered and understand exactly what it will execute, which is essential for validating persistence rather than merely suspecting it.

Answer

Sysmon Event ID 11, which records file creation events

Answer

Windows Security Event ID 7045 from the System log, which records service installation

Answer

Windows Security Event ID 4625, which records failed logon attempts

Question 7

You are a Splunk ES analyst investigating a notable event for an unusual login from a foreign IP. You need to determine the full context of the user's activity around that time, including all related authentication and VPN events. Which feature in Splunk Enterprise Security provides this consolidated view directly from the Incident Review dashboard?

Accepted Answer

Identity Investigator. Identity Investigator is the Splunk ES feature that aggregates and displays a user's activity across multiple data sources, enabling analysts to quickly understand the context of a notable event involving a specific user. It pulls together authentication, VPN, and other identity-related events, which is exactly what is required here.

Answer

Asset Investigator

Answer

Threat Intelligence Framework

Answer

Protocol Intelligence

Question 8

A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?

Accepted Answer

Data Model Acceleration. Data Model Acceleration (DMA) pre-computes and stores summarized results for data models, allowing tstats searches to run against the accelerated summaries instead of raw events. This makes correlation searches that span large datasets across multiple indexes fast and efficient, because the correlation search can use tstats against accelerated data models rather than scanning raw events. This is the ES-recommended approach for high-volume correlation.

Answer

Summary Indexing

Answer

Correlation Search Tuning

Answer

Lookup file generation

Question 9

Which TWO of the following commands are used for data transformation or enrichment?

Accepted Answer

lookup. Option D, lookup, is correct because it enriches events by joining fields from an external lookup table (e.g., CSV or KV Store) into the search results, adding context such as user names or asset owners. Option E, eval, is correct because it calculates and transforms field values using expressions and functions, creating new fields or modifying existing ones for analysis. Option A, search, is not a transformation or enrichment command; it retrieves and filters events matching a query. Option B, index, is an ingestion/administration command that writes data into an index rather than transforming it. Option C, head, only returns the first N results and does not transform or enrich data.

Answer

search

Answer

index

Answer

head

Question 10

A defense analyst wants to correlate proxy logs and firewall logs to find internal hosts that contacted a known-malicious domain. The proxy logs store the field dest_host and the firewall logs store the field fqdn, and both indexes contain a common field src_ip. The analyst wants a single result set showing src_ip values present in both data sources for the same domain. Which SPL approach returns only hosts seen in both logs for matching domains?

Accepted Answer

index=proxy OR index=firewall | eval domain=coalesce(dest_host, fqdn) | stats values(index) AS sources BY src_ip domain | where mvcount(sources)>1. Correlating two sources with differently named domain fields requires normalizing them first. coalesce unifies dest_host and fqdn into one domain field, then stats BY src_ip domain collects which indexes contributed. Keeping only groups where more than one distinct index appears yields the strict intersection of hosts and domains seen in both proxy and firewall logs.

Answer

index=proxy OR index=firewall | transaction src_ip | search dest_host=* fqdn=*

Answer

index=proxy OR index=firewall | stats values(dest_host) AS d values(fqdn) AS f BY src_ip | where isnotnull(d) AND isnotnull(f)

Answer

index=proxy OR index=firewall | eval domain=dest_host . fqdn | stats count BY src_ip domain | where count>1

Question 11

A SOC analyst is reviewing a notables list in Splunk Enterprise Security and wants to see the individual risk events that contributed to a specific notable's risk score. The analyst opens the notable's detail view and looks for a way to pivot directly to the contributing risk events. Which action should the analyst take?

Accepted Answer

Click the 'Risk Event' link in the notable's detail view to open a search pre-filtered by the notable's risk object.. The Risk Event link in a notable's detail view is the built-in pivot that launches a search against the risk index filtered to the notable's risk object. This lets the analyst immediately see every risk event that contributed to the score, which is essential for understanding why the notable fired. Manually searching the notable index or exporting the notable cannot expose those underlying risk events.

Answer

Export the notable as a PDF and review the embedded risk event table.

Answer

Run a search using the 'from' command against the notable index to retrieve related risk events.

Answer

Use the 'collect' command to copy the notable into the risk index and then search it.

Question 12

Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?

Accepted Answer

Hypothesis Generation. Hypothesis Generation is the phase of the proactive threat hunting methodology where the hunter formulates a specific, testable hypothesis about a threat actor, technique, or behavior to investigate. This phase defines what to hunt for, based on threat intelligence, ATT&CK techniques, or environmental anomalies, before any data collection or execution occurs.

Answer

Data Preparation

Answer

Reporting

Answer

Hunt Execution

Question 13

When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?

Accepted Answer

Creates an entry in the Incident Review dashboard.. The 'Notable' adaptive response action in Splunk ES creates a notable event that appears in the Incident Review dashboard, allowing analysts to triage, assign, and track the finding. It's the primary mechanism for surfacing correlation search hits to the SOC workflow.

Answer

Updates the asset identity table.

Answer

Assigns a risk score to an event.

Answer

Sends an email alert.

Question 14

A Splunk ES analyst receives a notable event indicating that a user account has been locked out due to multiple failed login attempts. The analyst wants to determine if this is a brute force attack or a user error. Which data model should the analyst examine to review the authentication activity for that user?

Accepted Answer

Authentication. The Authentication data model is designed to normalize login activity from multiple sources, making it the ideal place to investigate failed login attempts and account lockouts. By examining this data model, analysts can see the frequency and source of failed logins, helping distinguish between a brute force attack and a user mistake. Other data models do not contain authentication events.

Answer

Change

Answer

Network Traffic

Answer

Endpoint

Question 15

An analyst is triaging a suspected brute-force attack and needs to view raw event text alongside a computed field showing how many seconds elapsed between consecutive failed logins from the same source IP. The events must remain individually visible, in time order, with the delta shown per event. Which SPL search best meets this need?

Accepted Answer

index=auth action=failed | sort 0 + _time | streamstats window=1 current=f global=f last(_time) AS prev_time BY src_ip | eval delta=_time-prev_time. To keep events individual while computing a gap against the previous event in the same group, streamstats with window=1 and current=f is the right tool. It references the prior event's _time per src_ip, and eval subtracts to produce the delta. Sorting by _time first guarantees the running calculation follows true chronological order.

Answer

index=auth action=failed | delta _time AS delta BY src_ip

Answer

index=auth action=failed | transaction src_ip | eval delta=duration

Answer

index=auth action=failed | stats range(_time) AS delta BY src_ip