SPLK-5001 Practice Test 19 — 15 Questions

Question 1

A security team is using Splunk Enterprise Security to monitor for suspicious activity. They want to create a correlation search that triggers a notable event when a user's risk score exceeds a certain threshold. Which Splunk ES feature should they use to automatically adjust risk scores based on events?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Risk Analysis framework. The Risk Analysis framework is designed to assign and modify risk scores for entities based on events. It allows security teams to create risk rules that adjust scores, and correlation searches can then trigger notables when a risk threshold is met. This enables risk-based alerting. Other features like suppression, adaptive response, and threat intelligence serve different purposes and do not adjust risk scores. Therefore, the Risk Analysis framework is the correct choice.

Answer

Adaptive Response

Answer

Threat Intelligence framework

Answer

Notable Event Suppression

Question 2

What is the purpose of the 'Assets and Identities' framework in Splunk ES?

Accepted Answer

To provide context like department and role to security events.. The Assets and Identities framework in Splunk ES enriches security events with contextual metadata such as department, role, priority, and location by correlating event fields (e.g., src, dest, user) against lookup tables. This context helps analysts prioritize and understand the business impact of detections.

Answer

To manage user passwords.

Answer

To store audit logs for compliance.

Answer

To define the network topology.

Question 3

A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?

Accepted Answer

User Activity. The User Activity dashboard in Splunk Enterprise Security is the correct location because it aggregates identity-centric information including recent logins, authentication history, and associated risk for a specific user. When investigating a potentially compromised account, analysts pivot to User Activity to see the timeline of successful and failed logons, source IPs, and related notable events. This view is purpose-built for identity investigation and is distinct from the broader Incident Review queue.

Answer

Threat Intelligence

Answer

Asset Investigator

Answer

Incident Review

Question 4

Which TWO actions should be taken if a correlation search is consuming too many system resources?

Accepted Answer

Reduce the search frequency (cron schedule).. Option A is correct because reducing the search frequency (cron schedule) directly lowers how often the correlation search executes, cutting CPU, memory, and I/O load on the search head and indexers. Option E is correct because optimizing the search query with data model accelerated fields lets Splunk use pre-computed, summarized data instead of scanning raw events, dramatically reducing resource consumption and search time. Re-installing Splunk Enterprise (B) does not address the underlying resource cost of the search and risks unnecessary downtime. Deleting all historical data (C) is destructive, unnecessary, and does not fix the search's inefficiency. Switching operating systems (D) is irrelevant to search resource usage and would not resolve the problem.

Answer

Re-install the Splunk Enterprise application.

Answer

Delete all historical data.

Answer

Switch to a different operating system.

Question 5

A SOC analyst receives an alert that a user's credentials were used from two geographically distant locations within five minutes. Which Splunk ES capability is designed to surface this type of anomaly by comparing current activity to a learned baseline?

Accepted Answer

User Behavior Analytics (UBA), which builds peer-group and individual baselines to detect anomalous access patterns such as impossible travel.. Impossible travel is a behavioral anomaly: the same user cannot physically move between distant locations in minutes. UBA learns each user's normal access patterns and peer-group norms, so a login pair that violates travel-time expectations stands out. That learned baseline is precisely what distinguishes UBA from enrichment-only or risk-aggregation features.

Answer

Risk-based alerting, which aggregates risk scores from multiple correlation searches into a single notable event for triage.

Answer

The Asset and Identity framework, which correlates events with asset ownership and identity metadata.

Answer

The Threat Intelligence framework, which enriches events with indicators of compromise from external feeds.

Question 6

A security analyst wants to correlate login and logout events for each user to calculate session durations. The events have fields 'user', 'action' (login or logout), and '_time'. Which SPL command sequence is most efficient to pair each login with the subsequent logout for the same user?

Accepted Answer

index=auth action=login OR action=logout | sort 0 user _time | streamstats current=f last(_time) as login_time by user | where action="logout" | eval duration = _time - login_time. To pair sequential login and logout events per user, sorting by user and time, then using streamstats to carry forward the previous event's time, allows calculation of duration when a logout occurs. This method is efficient and scales better than transaction or join.

Answer

index=auth action=login OR action=logout | transaction user startswith=action="login" endswith=action="logout" | eval duration = duration

Answer

index=auth action=login OR action=logout | join user [search index=auth action=login | rename _time as login_time] | where action="logout" | eval duration = _time - login_time

Answer

index=auth action=login OR action=logout | stats earliest(_time) as login_time latest(_time) as logout_time by user | eval duration = logout_time - login_time

Question 7

During an investigation, an analyst determines that a user's risk score is inflated because a single risk rule is firing repeatedly on benign activity. The analyst wants to reduce the impact of this rule on the user's overall risk score without disabling the rule entirely. What is the most appropriate action?

Accepted Answer

Create a risk rule exception or a throttling configuration for the rule so it does not repeatedly add risk for the same user within a time window.. Risk score inflation from a single noisy rule is best handled by throttling or adding an exception so the rule does not repeatedly add risk for the same entity within a defined window. This preserves the rule's value for other entities and scenarios while preventing the specific user from accumulating disproportionate risk from benign activity.

Answer

Edit the risk rule's stanza in `risk_rules.conf` and set the `risk_score` value to a lower number.

Answer

Modify the user's risk score manually in the Risk Analysis dashboard by subtracting points from the current total.

Answer

Change the user's risk object type in the identity lookup so the rule no longer matches the user.

Question 8

An analyst is hunting for evidence that an adversary used the Windows command shell to spawn a script interpreter in a suspicious parent-child relationship. The endpoint telemetry is in Splunk via Sysmon EventCode 1. Which search most directly surfaces processes whose parent is cmd.exe and whose image is a scripting engine?

Accepted Answer

index=sysmon EventCode=1 ParentImage="*\cmd.exe" Image IN ("*\powershell.exe","*\wscript.exe","*\cscript.exe","*\mshta.exe") | table _time, ComputerName, ParentImage, Image, CommandLine. Process creation telemetry from Sysmon EventCode 1 includes both the Image and ParentImage fields, enabling lineage-based hunting. Constraining ParentImage to cmd.exe and Image to a set of scripting engines isolates the living-off-the-land execution pattern where a shell launches an interpreter, which is a common step in scripted intrusions and worth triaging.

Answer

index=sysmon EventCode=1 Image="*\cmd.exe" | table _time, ComputerName, CommandLine

Answer

index=sysmon EventCode=3 ParentImage="*\cmd.exe" | table _time, ComputerName, DestinationIp, DestinationPort

Answer

index=sysmon EventCode=1 | stats count by Image | sort - count | head 20

Question 9

A security analyst is building a search to identify brute force attacks. They want to use the 'stats' command to calculate the count of failed login attempts per source IP, and then filter for IPs with more than 10 failures. They also want to include the earliest and latest timestamps of these failures. Which two SPL commands or functions should be used to achieve this? (Choose two.)

Accepted Answer

stats count as failures, min(_time) as earliest, max(_time) as latest by src_ip. To identify brute force attacks, the analyst needs to aggregate failed login attempts per source IP and then filter for those exceeding a threshold. The stats command with count, min(_time), and max(_time) by src_ip provides the necessary aggregation. The where command then filters the aggregated results for failures greater than 10. Together, these commands produce the required output. The other options either filter incorrectly, create unnecessary fields, or fail to aggregate properly.

Answer

eval failures = count > 10

Answer

search failures > 10

Answer

stats count by src_ip, failures

Question 10

An analyst is investigating a suspected DNS tunneling attack. Which Splunk ES data model and field should be used to identify hosts making an unusually high number of unique DNS queries with long subdomain strings?

Accepted Answer

Network_Resolution data model, using the `query` field and calculating the length of subdomain labels. DNS tunneling encodes data in subdomain labels, so detection requires examining the DNS query strings themselves. The Network_Resolution data model provides normalized DNS query and response fields, enabling Splunk ES searches that calculate query length, entropy, and uniqueness per host to flag potential tunneling.

Answer

Web data model, using the `uri_path` field to detect long encoded strings

Answer

Endpoint data model, analyzing `process_name` for `nslookup.exe` executions

Answer

Network_Traffic data model, filtering on `dest_port` 53 and measuring `bytes_in`

Question 11

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

Accepted Answer

Network Traffic. The Network Traffic data model in the Splunk Common Information Model (CIM) is designed to normalize network connection events, including source/destination IPs, ports, protocols, and domain names. A system process attempting an outbound connection to a suspicious external domain would generate network telemetry (e.g., from firewalls, proxies, or Zeek) that maps to this model. Therefore, Network Traffic is the correct CIM data model to search for such activity.

Answer

Authentication

Answer

Change Analysis

Answer

Endpoint

Question 12

Which THREE features are provided by the Splunk ES Incident Review dashboard?

Accepted Answer

Status management. The Splunk ES Incident Review dashboard provides Status management (A), allowing analysts to change a notable event's status through the workflow (e.g., New, In Progress, Resolved, Closed) to track triage progress. It also supports Notable event assignment (C), letting analysts assign notables to a specific owner or analyst for accountability. Additionally, it offers Notable event filtering (D), enabling analysts to narrow the notable list by fields such as urgency, status, owner, or source. Option B is incorrect because risk score threshold configuration is done via correlation search settings or the Risk Framework, not on the Incident Review dashboard. Option E is incorrect because threat intelligence feed management is handled through the Threat Intelligence Framework and its associated configurations, not the Incident Review dashboard.

Answer

Risk score threshold configuration

Answer

Threat intelligence feed management

Question 13

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

Accepted Answer

Endpoint. The Endpoint data model in Splunk is designed to normalize process execution, file system activity, and registry events from endpoint telemetry sources such as Sysmon, Windows Event Logs, and CrowdStrike. It includes process_name, process_path, parent_process_name, and user fields that allow correlation of a running process against its expected filesystem path. Comparing a renamed system process (e.g., svchost.exe running from C:\Temp) against known good paths is exactly the process-path correlation the Endpoint model supports.

Answer

Authentication

Answer

Network Traffic

Answer

Change Analysis

Question 14

A security analyst is configuring a new data model in Splunk Enterprise Security to accelerate a correlation search. After creating the data model, the analyst notices that the correlation search is still not performing efficiently. What is the most likely reason for the poor performance?

Accepted Answer

The data model has not been accelerated.. Data model acceleration is essential for improving the performance of searches that use the data model. Without acceleration, the data model does not store precomputed results, so correlation searches must scan raw data, resulting in slower execution. Enabling acceleration allows the search to use the accelerated summaries, which are much faster to query.

Answer

The data model does not have any constraints defined.

Answer

The correlation search is using a slow search command.

Answer

The correlation search is not scheduled to run frequently enough.

Question 15

A Splunk ES analyst receives a notable event for 'Excessive Failed Logins' on a Windows server. The analyst wants to determine if this is a brute-force attack or a misconfigured service account. Which field in the notable event would best help differentiate between these two scenarios?

Accepted Answer

user. The user field is critical because it reveals which account is experiencing failures. A single service account with repeated failures suggests misconfiguration, while multiple user accounts or a privileged account targeted from an external IP indicates brute-force. The other fields provide context but do not directly differentiate between the two causes.

Answer

signature

Answer

dest

Answer

src