SPLK-5001 Practice Test 20 — 15 Questions

Question 1

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Risk Analysis. Risk Analysis in Splunk Enterprise Security is the framework that assigns risk scores to entities (users, systems, IPs) based on risk-modifying searches and correlation searches. Because risk scores accumulate over time and are tied to a specific entity via the risk object, it is the feature designed to correlate many events occurring across a long duration to a single entity. This makes it the correct tool for tracking slow, low-and-slow insider threat behavior such as gradual data exfiltration.

Answer

Notable Event Aggregation

Answer

Asset Investigator

Answer

Threat Activity

Question 2

You are using 'lookup' to add user info. What happens if the common field doesn't exist in the lookup file?

Accepted Answer

The events without a match are left with null values in the lookup fields.. The lookup command enriches events by matching a field in the event stream against a field in a lookup table. When no match is found for a given event, that event is retained in the results but the fields brought in from the lookup are populated with null values. This preserves the full event set while adding enrichment where possible, which is essential for accurate reporting and downstream analysis.

Answer

The lookup file is renamed.

Answer

The events without a match are deleted.

Answer

The entire search fails.

Question 3

A risk analyst notices that a user account accumulated a high risk score from multiple contributing risk events, but the score does not reflect the expected sum of the individual risk rule weights. Which factor most likely explains the discrepancy?

Accepted Answer

Risk event retention expired for some contributing events, so only events still within the risk index retention window are counted.. An entity's risk score reflects the risk events currently present in the risk index within the relevant scoring window. If some contributing events have exceeded the risk index retention period, they are no longer available to contribute, making the observed score lower than the sum of all rule weights the analyst expects. Retention and scoring window settings therefore directly affect the calculated total.

Answer

Risk scores are normalized against the total number of users in the identity lookup, reducing per-user values.

Answer

The risk score is capped by the maximum risk score threshold configured for the risk index, limiting how high it can climb.

Answer

The risk score is recalculated only when a new notable event is generated, so recent risk events are not yet included.

Question 4

Which TWO methods can be used to suppress unwanted notable events?

Accepted Answer

Correlation search suppression. Correlation search suppression (A) is correct because it lets you configure a correlation search to suppress the creation of notable events when specified conditions are met, such as a suppression field or time window, directly preventing unwanted notables at the search level. Notable event suppression (D) is correct because it allows you to suppress individual or grouped notable events after they are generated, using rules based on fields like rule name, source, or severity, so recurring or duplicate notables are hidden from analysts. Deleting the raw event from the index (B) is not a valid suppression method; it destroys source data, affects all searches, and does not target notable events specifically. Changing the user account password (C) is unrelated to event suppression and only affects authentication. Disabling the data model (E) would break the correlation searches and dashboards that depend on it rather than selectively suppressing unwanted notable events.

Answer

Deleting the raw event from the index

Answer

Changing the user account password

Answer

Disabling the data model

Question 5

An analyst is investigating a potential ransomware outbreak. They observe a high volume of file encryption activity and want to identify the initial infection vector. Which TWO of the following Splunk ES data models would be most useful to correlate endpoint and network activity to trace the source? (Choose two.)

Accepted Answer

Endpoint. Tracing a ransomware infection requires correlating endpoint process activity with network communications. The Endpoint data model reveals the execution chain and file modifications, while the Network_Traffic data model shows external connections that may indicate the delivery or C2. Together, they provide a comprehensive view to identify the initial vector.

Answer

Malware

Answer

Authentication

Answer

Web

Question 6

You are configuring a 'Notable Event' to use a specific 'Drilldown' link. What syntax is used to pass fields from the event into the URL?

Accepted Answer

$field_name$. In Splunk Enterprise Security notable event drilldown configuration, token substitution uses the dollar-sign syntax $field_name$ to inject field values from the triggering event into the drilldown URL. This is the same token syntax used throughout Splunk dashboards and is the documented format for ES drilldown links. The tokens are replaced at render time with the actual field values from the notable event.

Answer

{field_name}

Answer

%field_name%

Answer

[field_name]

Question 7

Which TWO factors directly impact the urgency of a notable event in Splunk ES?

Accepted Answer

The risk score of the event.. In Splunk Enterprise Security, the urgency of a notable event is calculated from the event's risk score and the criticality of the asset or identity involved, so option C (the risk score of the event) is correct because higher-risk scores raise urgency, and option D (the criticality of the asset involved) is correct because a mission-critical asset increases the urgency of the notable event. These two factors are combined by the urgency calculation (risk score × asset/identity criticality) to produce the urgency level shown on the Incident Review dashboard. Option A is incorrect because dashboard color schemes are purely cosmetic and have no effect on urgency. Option B is incorrect because the total volume of indexed events is a licensing/performance metric, not an urgency input. Option E is incorrect because the number of active users in the system does not factor into the urgency calculation for a notable event.

Answer

The color scheme of the dashboard.

Answer

The total volume of indexed events.

Answer

The number of active users in the system.

Question 8

A security team is aligning its Splunk ES deployment with the NIST Cybersecurity Framework. The team wants to ensure that they can effectively respond to detected incidents by executing predefined procedures. Which NIST CSF function and category should they focus on to achieve this?

Accepted Answer

Respond (RS) - Response Planning (RS.RP). The NIST CSF Respond function includes Response Planning, which ensures that response processes and procedures are executed and maintained. This category is directly aimed at enabling organizations to respond effectively to detected cybersecurity incidents. By focusing on RS.RP, the team can establish, test, and improve their incident response plans, aligning with their goal of executing predefined procedures.

Answer

Identify (ID) - Business Environment (ID.BE)

Answer

Recover (RC) - Recovery Planning (RC.RP)

Answer

Detect (DE) - Detection Processes (DE.DP)

Question 9

Which THREE of the following are common indicators that a host has been infected with malware?

Accepted Answer

Unusual outbound network connection. Option A is correct because malware typically establishes command-and-control (C2) channels or exfiltrates data, producing unusual outbound connections to unfamiliar IP addresses or ports that deviate from the host's normal traffic baseline. Option B is correct because many malware families tamper with system-critical files—such as modifying boot records, system binaries, or registry keys—to achieve persistence, escalate privileges, or disable security controls. Option C is correct because unexpected process execution, such as unknown or suspicious processes spawning from unusual parent processes, is a hallmark of malware running on a host. Option D is not an indicator of infection, since a successful user logout is a normal, expected system event. Option E is also not an indicator, as a user password reset is a legitimate administrative or self-service action rather than evidence of compromise.

Answer

Successful user logout

Answer

User password reset

Question 10

You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?

Accepted Answer

EventCode 10. Sysmon EventCode 10 is the correct answer because it specifically logs process access events, including when a process opens a handle to another process with memory-read permissions. Credential dumping tools such as Mimikatz must access lsass.exe memory to extract credentials, so EventCode 10 with a TargetImage of lsass.exe and a GrantedAccess mask indicating read access is the primary detection signal. This event is the most direct Sysmon telemetry for identifying LSASS memory access.

Answer

EventCode 1

Answer

EventCode 11

Answer

EventCode 3

Question 11

When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?

Accepted Answer

Use the CIM Validator app to check compliance against the data model.. The CIM Validator app is specifically designed to validate whether indexed data is correctly mapped to the Common Information Model (CIM) data models, including Network Traffic. It provides detailed reports on missing or misconfigured fields, making it the most efficient first troubleshooting step. This directly identifies CIM mapping gaps without disruptive changes.

Answer

Disable and re-enable the Enterprise Security app.

Answer

Change the sourcetype to 'cisco_asa' manually.

Answer

Re-index all firewall logs from the past 30 days.

Question 12

A security team is using Splunk Enterprise Security to monitor for malware infections. They want to ensure that the 'Malware' data model is populated with events from their endpoint protection logs. The endpoint logs are already being ingested and have the correct sourcetype. Which CIM data model should the team map these logs to?

Accepted Answer

Malware. The Malware data model is the correct CIM data model for endpoint protection logs that report malware infections. It provides a standardized schema for malware events, enabling correlation searches and dashboards to work across different vendors. The other data models serve different purposes: Endpoint for general endpoint activity, Intrusion_Detection for IDS/IPS, and Network_Traffic for flow data. Proper mapping ensures that the malware data is usable in ES.

Answer

Network_Traffic

Answer

Intrusion_Detection

Answer

Endpoint

Question 13

An analyst is investigating a potential data exfiltration incident and wants to determine the adversary's stage according to the Cyber Kill Chain. The analyst observes large outbound transfers to an unfamiliar external IP address after a period of internal reconnaissance. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Actions on Objectives. The Cyber Kill Chain phase Actions on Objectives encompasses the adversary's ultimate goal, which often includes data exfiltration. The large outbound transfers to an unfamiliar external IP after reconnaissance strongly indicate that the adversary is now stealing data. Recognizing this phase helps analysts prioritize containment and recovery efforts, as the breach has progressed to its final stage.

Answer

Exploitation

Answer

Installation

Answer

Command and Control

Question 14

Which THREE of the following are valid uses of the 'eval' command?

Accepted Answer

eval is_error = if(status>400, 1, 0). Option A is correct because eval can create a new field using a conditional expression, and if(status>400, 1, 0) is a valid eval function that returns 1 when status exceeds 400 and 0 otherwise. Option B is correct because eval supports arithmetic expressions, so eval new_field = field1 + field2 computes the sum of two existing numeric fields and stores it in new_field. Option E is correct because eval can concatenate string values with the + operator, so eval full_name = first + " " + last builds a full name by joining first, a space, and last. Option C is not a valid eval use because 'by host' is a splitting/aggregation clause used with commands like stats, chart, or timechart, not eval. Option D is not a valid eval use because 'filter status=200' is a filtering operation, typically done with search or where, and eval does not filter events.

Answer

eval count by host

Answer

eval filter status=200

Question 15

You want to calculate the standard deviation of 'response_time' per 'server'. Which command is correct?

Accepted Answer

stats stdev(response_time) as std_dev by server. The stats command supports stdev() as the statistical function for standard deviation. The syntax 'stats stdev(response_time) as std_dev by server' correctly computes the standard deviation of response_time grouped by server. variance() computes variance (the square of standard deviation), and sigma() and dev() are not valid SPL statistical functions.

Answer

stats variance(response_time) as std_dev by server

Answer

stats sigma(response_time) by server

Answer

stats dev(response_time) by server