SPLK-5001 Practice Exam 1 — 20 Questions

Question 1

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Accepted Answer

Reconnaissance. The Cyber Kill Chain consists of Reconnaissance, Weaponization, Delivery, Exploitation, Installation, C2, and Actions on Objectives.

Answer

Containment

Answer

Patching

Question 2

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

Accepted Answer

Utilizing the 'mitre_attack_id' field within the Threat Intelligence framework.. The MITRE ATT&CK mapping in ES relies on the 'mitre_attack_id' field within the threat intelligence framework to correlate events with the enterprise matrix.

Answer

Hardcoding the technique description into the 'dest_host' field.

Answer

Configuring the 'correlation_rule_id' to match the ATT&CK tactic name.

Answer

Mapping the source IP to the 'mitre_source_id' field.

Question 3

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

Accepted Answer

Domain Names. ES allows for the management of Indicators of Compromise (IoCs) including IP addresses, file hashes, and domain names.

Answer

User Session Tokens

Answer

Network Topology Maps

Question 4

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Accepted Answer

Enablement of the 'Splunk App for CIS Benchmarks'.. To report on CIS benchmarks, you need to collect the configuration data and have a mechanism to compare it against the expected state (the benchmark).

Answer

Configure all logs to use the 'Syslog' protocol only.

Answer

Install a third-party antivirus solution.

Answer

Configure the index to 'Hot/Warm' storage only.

Question 5

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

Accepted Answer

Command and Control (C2).. Egress filtering prevents infected hosts from communicating with external Command and Control (C2) servers.

Answer

Installation.

Answer

Reconnaissance.

Answer

Exploitation.

Question 6

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

Accepted Answer

Notable Events framework.. The 'Notable Events' framework and 'Correlation Searches' are the primary mechanisms in ES for detecting and surfacing security anomalies.

Answer

Workload Management.

Answer

Data Model acceleration.

Answer

Report acceleration.

Question 7

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Accepted Answer

Scanning external IP ranges for open ports.. Reconnaissance involves active or passive research performed by an attacker to gather information on a target's infrastructure.

Answer

Sending a spear-phishing email.

Answer

Encrypting user files for ransom.

Answer

Installing a backdoor on a web server.

Question 8

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

Accepted Answer

Detect. The five core functions of NIST CSF are Identify, Protect, Detect, Respond, and Recover.

Answer

Report

Answer

Eradicate

Question 9

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

Accepted Answer

Case Management. Case Management provides the structure and tools for incident lifecycle management.

Answer

Notable Event Suppression

Answer

Risk Analysis Dashboard

Answer

Incident Review

Question 10

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

Accepted Answer

Risk Analysis Dashboard. The 'Risk Analysis' dashboard displays a timeline and list of events that contributed to an object's current risk score.

Answer

Security Posture Dashboard

Answer

Investigation Workbench

Answer

Incident Review

Question 11

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

Accepted Answer

It focuses on aggregated behavior to reduce noise.. RBA reduces alert fatigue by focusing on aggregated activity rather than single, potentially noisy events.

Answer

It alerts on every single event.

Answer

It eliminates the need for correlation searches.

Answer

It ignores all low-severity events.

Question 12

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Accepted Answer

Change Analysis. The 'Change Analysis' data model tracks significant system changes, including clearing security logs.

Answer

Endpoint

Answer

Network Traffic

Answer

Authentication

Question 13

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

Accepted Answer

The 'Incident Review' dashboard for documenting resolution steps.. The 'Incident Review' dashboard and the 'Notable Event' workflow actions allow for the documentation and categorization of incident resolution and recovery steps.

Answer

The 'Data Model Acceleration' settings.

Answer

The 'Threat Intelligence' upload manager.

Answer

The 'Workflow Actions' settings for firewall rule creation.

Question 14

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

Accepted Answer

Assets and Identity Data Model.. The 'Inventory' data model (part of the Common Information Model) is the foundation for asset tracking in Splunk ES.

Answer

Vulnerability Data Model.

Answer

Endpoint Data Model.

Answer

Network Traffic Data Model.

Question 15

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

Accepted Answer

Navigate to the 'Compliance' tab and run a report on 'Framework Coverage'.. The 'Content Introspection' or 'Security Content' dashboard in SSE allows users to filter by framework and maturity to identify coverage gaps.

Answer

Manually edit the 'Data Model' accelerations for NIST compliance.

Answer

Modify the 'Notable Event' aggregation policy to NIST standards.

Answer

Update the 'Threat Intelligence' index settings to include NIST tags.

Question 16

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Accepted Answer

Email gateway logs and web proxy logs.. The Delivery phase involves getting the malicious payload to the target, typically via email, web, or file transfer.

Answer

Domain Controller authentication logs.

Answer

Internal host process creation logs.

Answer

Endpoint file integrity monitoring.

Question 17

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

Accepted Answer

Email security logs or Web Proxy logs.. Initial Access often occurs via phishing or exploited public-facing applications, making web or email logs primary investigation targets.

Answer

Local authentication logs.

Answer

Process audit logs.

Answer

Registry modification logs.

Question 18

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

Accepted Answer

Executing code to take advantage of a vulnerability.. The Exploitation phase involves the attacker taking advantage of a vulnerability to gain access to the system.

Answer

Establishing a persistent connection to the attacker.

Answer

Exfiltrating sensitive company data.

Answer

Gathering information about the target.

Question 19

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

Accepted Answer

Splunk App for CIS Benchmarks.. Splunk Add-on for CIS (or specifically the Splunk App for CIS Benchmarks) is the designated tool for importing and visualizing these audits.

Answer

Splunk Add-on for Linux Auditd.

Answer

Splunk App for Infrastructure (SAI).

Answer

Splunk Enterprise Security Vulnerability Scanner.

Question 20

You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?

Accepted Answer

Connectivity and credentials in the specific Add-on configuration.. The Splunk Add-on for the device must be configured with correct credentials and network connectivity must be verified between the Splunk instance and the device.

Answer

The indexer cluster master status.

Answer

The number of active users in Splunk.

Answer

The notable event retention policy.