SPLK-5001 Practice Test 2 — 10 Questions

Question 1

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

Accepted Answer

It focuses on aggregated behavior to reduce noise.. RBA reduces alert fatigue by focusing on aggregated activity rather than single, potentially noisy events.

Answer

It alerts on every single event.

Answer

It eliminates the need for correlation searches.

Answer

It ignores all low-severity events.

Question 2

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Accepted Answer

Change Analysis. The 'Change Analysis' data model tracks significant system changes, including clearing security logs.

Answer

Endpoint

Answer

Network Traffic

Answer

Authentication

Question 3

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

Accepted Answer

The 'Incident Review' dashboard for documenting resolution steps.. The 'Incident Review' dashboard and the 'Notable Event' workflow actions allow for the documentation and categorization of incident resolution and recovery steps.

Answer

The 'Data Model Acceleration' settings.

Answer

The 'Threat Intelligence' upload manager.

Answer

The 'Workflow Actions' settings for firewall rule creation.

Question 4

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

Accepted Answer

Assets and Identity Data Model.. The 'Inventory' data model (part of the Common Information Model) is the foundation for asset tracking in Splunk ES.

Answer

Vulnerability Data Model.

Answer

Endpoint Data Model.

Answer

Network Traffic Data Model.

Question 5

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

Accepted Answer

Navigate to the 'Compliance' tab and run a report on 'Framework Coverage'.. The 'Content Introspection' or 'Security Content' dashboard in SSE allows users to filter by framework and maturity to identify coverage gaps.

Answer

Manually edit the 'Data Model' accelerations for NIST compliance.

Answer

Modify the 'Notable Event' aggregation policy to NIST standards.

Answer

Update the 'Threat Intelligence' index settings to include NIST tags.

Question 6

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Accepted Answer

Email gateway logs and web proxy logs.. The Delivery phase involves getting the malicious payload to the target, typically via email, web, or file transfer.

Answer

Domain Controller authentication logs.

Answer

Internal host process creation logs.

Answer

Endpoint file integrity monitoring.

Question 7

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

Accepted Answer

Email security logs or Web Proxy logs.. Initial Access often occurs via phishing or exploited public-facing applications, making web or email logs primary investigation targets.

Answer

Local authentication logs.

Answer

Process audit logs.

Answer

Registry modification logs.

Question 8

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

Accepted Answer

Executing code to take advantage of a vulnerability.. The Exploitation phase involves the attacker taking advantage of a vulnerability to gain access to the system.

Answer

Establishing a persistent connection to the attacker.

Answer

Exfiltrating sensitive company data.

Answer

Gathering information about the target.

Question 9

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

Accepted Answer

Splunk App for CIS Benchmarks.. Splunk Add-on for CIS (or specifically the Splunk App for CIS Benchmarks) is the designated tool for importing and visualizing these audits.

Answer

Splunk Add-on for Linux Auditd.

Answer

Splunk App for Infrastructure (SAI).

Answer

Splunk Enterprise Security Vulnerability Scanner.

Question 10

You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?

Accepted Answer

Connectivity and credentials in the specific Add-on configuration.. The Splunk Add-on for the device must be configured with correct credentials and network connectivity must be verified between the Splunk instance and the device.

Answer

The indexer cluster master status.

Answer

The number of active users in Splunk.

Answer

The notable event retention policy.