SPLK-5001 Practice Test 18 — 15 Questions

Question 1

Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?

Accepted Answer

Incident Review.. Incident Review is the Splunk Enterprise Security workbench where analysts triage, assign, comment on, and change the status of notable events (e.g., New, In Progress, Resolved, Closed). It is the primary UI for managing the full lifecycle of a notable event, including ownership, urgency, and disposition. The other features serve different purposes: suppression prevents creation, risk analysis scores entities, and asset/identity investigation enriches context.

Answer

Asset and Identity Investigation.

Answer

Notable Event Suppression.

Answer

Risk Analysis Dashboard.

Question 2

A security analyst is mapping Splunk ES correlation searches to the MITRE ATT&CK framework. The analyst needs to identify the technique that describes adversaries using legitimate credentials to access accounts, which often enables lateral movement and evasion. Which MITRE ATT&CK technique should the analyst map to?

Accepted Answer

T1078 - Valid Accounts. The scenario describes adversaries leveraging legitimate credentials to access accounts, which is the definition of MITRE ATT&CK technique T1078 Valid Accounts. This technique covers initial access, persistence, privilege escalation, and defense evasion using valid accounts. Mapping to T1078 helps analysts detect anomalous logins and account misuse, aligning with the need to identify credential-based threats in Splunk ES.

Answer

T1110 - Brute Force

Answer

T1059 - Command and Scripting Interpreter

Answer

T1021 - Remote Services

Question 3

A Splunk ES analyst notices a spike in `Endpoint` data model events where `process_name` is `powershell.exe` with a command line containing `-EncodedCommand` and `DownloadString`, spawning from `winword.exe` on several finance workstations. Which MITRE ATT&CK technique does this activity most directly map to?

Accepted Answer

T1059.001 – Command and Scripting Interpreter: PowerShell. The activity shows PowerShell being used to execute an encoded, remotely downloaded payload, which is the defining behavior of the PowerShell sub-technique under Command and Scripting Interpreter. Splunk ES correlates process launch and script-block logging from the Endpoint data model, letting analysts identify this technique even when the command is obfuscated with Base64 encoding.

Answer

T1055 – Process Injection

Answer

T1548.002 – Abuse Elevation Control Mechanism: Bypass User Account Control

Answer

T1204.002 – User Execution: Malicious File

Question 4

You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?

Accepted Answer

$SPLUNK_HOME/etc/apps//bin. Custom Adaptive Response actions in Splunk ES that use a Python script require the script to be placed in the 'bin' directory of the app that defines the action, i.e., $SPLUNK_HOME/etc/apps//bin. This is where Splunk looks for executable scripts associated with the app.

Answer

The root of the Splunk installation directory.

Answer

/etc/system/bin

Answer

/var/lib/splunk/scripts

Question 5

You are hunting for evidence of data exfiltration over HTTP. You have web proxy logs ingested into Splunk and want to identify internal hosts that have uploaded an unusually large amount of data to external sites in the past week. Which field in the proxy logs is most relevant for measuring outbound data volume?

Accepted Answer

bytes_out. To detect data exfiltration, you must measure the volume of data leaving the network. In proxy logs, bytes_out captures the bytes sent from the internal host to the external server. Aggregating bytes_out per internal host and comparing against a baseline reveals anomalies indicative of exfiltration. Other fields like status_code or uri_path do not quantify data volume.

Answer

status_code

Answer

uri_path

Answer

bytes_in

Question 6

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Accepted Answer

Risk Analysis. The Risk Analysis dashboard in Splunk Enterprise Security is purpose-built to display risk score progression over time for entities such as users, systems, and other risk objects. It aggregates risk events generated by correlation searches and shows how scores accumulate and decay. This is the correct place to trace a specific user's historical risk trajectory.

Answer

Notable Event Analysis

Answer

Asset Investigator

Answer

Incident Review

Question 7

A Splunk ES analyst is configuring the Threat Intelligence Framework to ingest a STIX/TAXII feed. They need to ensure that the indicators are properly parsed and available for correlation. Which file type must be used to define the threat intelligence source?

Accepted Answer

conf. To define a threat intelligence source in Splunk ES, including STIX/TAXII feeds, you must use Splunk configuration files, specifically threat_intelligence.conf. This file allows you to specify the TAXII server details, authentication, and polling intervals. CSV, JSON, and XML are data formats for indicators but are not used to define the source itself.

Answer

CSV

Answer

JSON

Answer

XML

Question 8

Which THREE actions are part of the 'Incident Review' investigation workflow?

Accepted Answer

Changing the status of a notable. In the Incident Review investigation workflow, changing the status of a notable (C) is correct because analysts must move notables through states such as New, In Progress, Pending, Resolved, or Closed to reflect the investigation's progress. Triage of new notable events (D) is correct because the workflow begins by reviewing and prioritizing newly generated notables to determine which require investigation. Assigning notables to an analyst (E) is correct because ownership assignment ensures accountability and routes each notable to the appropriate person for follow-up. Updating system configuration files (A) is not part of the investigation workflow; that is a configuration/administration task, not an incident review action. Rebooting indexer nodes (B) is also not part of the workflow; it is an infrastructure maintenance operation unrelated to reviewing or triaging notables.

Answer

Updating system configuration files

Answer

Rebooting indexer nodes

Question 9

Which THREE of the following data sources are most valuable for detecting an insider threat?

Accepted Answer

Endpoint file activity. Endpoint file activity (B) is valuable because insider threats often manifest as abnormal file access, copying, or exfiltration attempts on hosts, which can be captured via endpoint detection and response (EDR) telemetry and file auditing. VPN authentication logs (C) are valuable because they reveal remote access patterns, including logins from unusual locations or times, failed attempts, and concurrent sessions that may indicate credential misuse by an insider. Email outbound traffic (E) is valuable because insiders frequently exfiltrate sensitive data through email attachments or messages, and monitoring SMTP/Exchange traffic, attachment sizes, and recipient domains can surface such behavior. Printer toner levels (A) are merely consumable-maintenance metrics with no security relevance to user behavior. Router uptime logs (D) only indicate device availability and reboots, providing no insight into insider activity or data movement.

Answer

Printer toner levels

Answer

Router uptime logs

Question 10

An analyst is reviewing a notables queue in Splunk Enterprise Security and wants to understand why a particular correlation search generated a high-severity finding. The analyst opens the finding in Incident Review and notices the severity is set to 'high', but the contributing risk score is only 40. Which component of the correlation search configuration most directly determines the severity displayed on the finding?

Accepted Answer

The 'severity' field defined in the correlation search's alert settings. A finding's severity is explicitly set by the correlation search that creates it, independent of the underlying risk score. When a notable shows high severity but a modest risk score, the explanation is that the correlation search's alert settings define severity directly. Analysts should inspect the correlation search configuration rather than assume severity is derived from risk score.

Answer

The risk score of the contributing risk events, which always maps directly to severity

Answer

The urgency field in the finding's Notable event attributes

Answer

The default severity assigned by the Risk Analysis data model's risk object

Question 11

An attacker uses a weaponized document that exploits a vulnerability to execute code without writing a file to disk. Which detection approach in Splunk ES is best suited to identify this fileless attack?

Accepted Answer

Search the Endpoint data model for suspicious process behavior such as script interpreters spawning from productivity applications and making network connections.. Fileless attacks execute code in memory, often by abusing legitimate interpreters invoked by a document reader. The Endpoint data model records process creation, parent-child relationships, and command lines, so detecting a script interpreter spawning from a productivity application and making network connections is the most reliable way to surface this activity.

Answer

Review firewall logs for inbound connections to the document authoring workstation on unusual ports.

Answer

Monitor antivirus scan logs for signature matches on the downloaded document.

Answer

Check the Web data model for HTTP downloads of files with double extensions from known-bad domains.

Question 12

You are hunting for anomalous PowerShell activity. Which THREE indicators or behaviors should you look for in your Splunk data?

Accepted Answer

Presence of '-enc' or '-encodedcommand' flags. Option A is correct because the -enc or -encodedcommand flags let attackers pass Base64-encoded scripts that evade plaintext command-line inspection, a classic sign of obfuscated PowerShell abuse. Option C is correct because PowerShell spawning LOLBins such as wmic.exe or certutil.exe indicates living-off-the-land tradecraft used for reconnaissance, download, or execution, which is highly anomalous for normal admin scripts. Option E is correct because outbound network connections originating from powershell.exe often reveal C2 beaconing, download cradles, or reverse shells, since legitimate PowerShell rarely initiates external connections. Option B is not a strong indicator because Get-Service is a routine, benign cmdlet used constantly by administrators and monitoring tools. Option D is not PowerShell-specific, as RDP logons are a separate authentication event that does not by itself indicate anomalous PowerShell behavior.

Answer

Execution of 'Get-Service' commands

Answer

User logons via RDP

Question 13

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

Accepted Answer

By checking the 'Search Name' field.. Notable events in Splunk Enterprise Security include a field called 'Search Name' that identifies the correlation search that generated the event. By checking this field, an analyst can verify which specific correlation search produced the notable event. The other options do not provide that direct linkage.

Answer

By running a search for the object.

Answer

By checking the 'Event ID'.

Answer

By looking at the index name.

Question 14

You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?

Accepted Answer

spath input=raw_data. The spath command is Splunk's dedicated SPL command for extracting fields from structured data formats like JSON and XML. Using 'spath input=raw_data' parses the JSON stored in the raw_data field and extracts its keys as Splunk fields, which can then be used in subsequent commands. This is the canonical way to extract JSON fields in SPL.

Answer

eval json_parse(raw_data)

Answer

json raw_data

Answer

extract json raw_data

Question 15

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

Accepted Answer

Risk Analysis Dashboard. The Risk Analysis Dashboard in Splunk ES provides a visual breakdown of risk contributors for a specific user (or other entity), showing which correlation searches contributed risk, the risk scores over time, and the risk objects involved. It is the go-to dashboard for understanding why a user's risk score is elevated and which detections drove it. This directly supports investigating a risk notable.

Answer

Threat Activity Dashboard

Answer

Access Anomalies Dashboard

Answer

Incident Review