SPLK-5001 Practice Exam 2 — 20 Questions

Question 1

Which field is mandatory for an event to be correctly categorized by the Common Information Model (CIM) 'Network Traffic' data model?

Accepted Answer

tag. The 'tag=network' and 'tag=communicate' (or similar) tags are required to map events to the Network Traffic data model.

Answer

user

Answer

src_ip

Answer

host

Question 2

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

Accepted Answer

Web. The 'Web' data model captures detailed information about web server traffic, including user-agents.

Answer

Network Traffic

Answer

Authentication

Answer

Endpoint

Question 3

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

Accepted Answer

tstats count from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe.. The 'tstats' command is the standard way to query data models efficiently, such as the 'Endpoint' model, to look for malicious PowerShell patterns.

Answer

search sourcetype=sysmon | rename command as powershell.

Answer

| inputlookup mitre_tactics | where process=powershell.

Answer

index=main | lookup mitre_attack_id.

Question 4

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

Accepted Answer

index=windows EventCode=4688 | stats count by ParentProcessName, ProcessName. Identifying abnormal parent-child relationships is a core hunting technique. Using tstats to aggregate process parent-child pairs is efficient.

Answer

index=windows EventCode=4697 | table User, ServiceName

Answer

index=windows EventCode=4624 | table Logon_Type, User

Answer

index=windows EventCode=7045 | stats count by ServiceName

Question 5

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

Accepted Answer

Using 'NOT' clauses to exclude known administrative processes. Filtering known-good values, using lookup tables for exclusions, and weighting alerts are all standard methods for noise reduction.

Answer

Deleting raw logs after indexing

Answer

Increasing the search time range

Question 6

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

Accepted Answer

By checking the 'Search Name' field.. The 'Search Name' field in the Incident Review dashboard clearly identifies the correlation search that triggered the notable.

Answer

By running a search for the object.

Answer

By checking the 'Event ID'.

Answer

By looking at the index name.

Question 7

What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?

Accepted Answer

It determines how long data remains in the Notable event storage.. This controls how long the KV Store and index data associated with ES remain available before being purged or aged out.

Answer

It changes the user access level.

Answer

It changes the search speed.

Answer

It increases the license limit.

Question 8

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Accepted Answer

Windows Security Event ID 4688 (Process Creation). Authentication logs (4624), process execution (4688), and service installation (7045) provide the necessary context to track an attacker moving between hosts.

Answer

Windows System Event ID 104 (Log Cleared)

Answer

Windows Security Event ID 4611 (Trusted Logon)

Question 9

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

Accepted Answer

Access Anomalies. The Access Anomalies dashboard provides a centralized view of authentication-related anomalies.

Answer

User Activity Center

Answer

Protocol Intelligence

Answer

Threat Intelligence Activity

Question 10

If an analyst wants to see all risk events associated with a specific IP address, which search command is most effective?

Accepted Answer

tstats count from datamodel=Risk where Risk.src_ip=.... The 'tstats' command is the most efficient way to query the risk data model for events associated with a specific field value.

Answer

collect index=risk

Answer

lookup asset_info

Answer

search index=risk src_ip=...

Question 11

Which THREE elements are essential for a well-defined risk-based alert?

Accepted Answer

A threshold for notable generation. RBA requires identifying the risk object, assigning a score, and using a correlation search to monitor that risk.

Answer

Manual approval for every alert

Answer

Hardware-level encryption

Question 12

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

Accepted Answer

Change the notable event status. Analysts can run adaptive response actions and manage the notable event status directly from this dashboard.

Answer

Modify the correlation search code

Answer

Rebuild the threat intelligence index

Answer

Delete the underlying index

Question 13

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

Accepted Answer

Contextual Asset and Identity information.. Success requires indexed data, normalized data (CIM), and contextual information (Assets/Identities).

Answer

A separate Splunk instance for every sourcetype.

Answer

A dedicated hardware appliance.

Question 14

What is the purpose of the 'Investigation Workbench' in Splunk ES?

Accepted Answer

To provide a unified view of incident artifacts.. The Investigation Workbench provides a centralized view of all entities, events, and context related to a specific incident.

Answer

To run administrative index maintenance.

Answer

To manage user identities.

Answer

To configure correlation searches.

Question 15

You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?

Accepted Answer

splunkd.log. The splunkd.log file contains internal diagnostic information about adaptive response actions executed by the correlation search scheduler.

Answer

correlation_search.log

Answer

notable_events.log

Answer

risk_index.log

Question 16

A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?

Accepted Answer

Data Model Acceleration. Data model acceleration allows Splunk to pre-calculate and store data models, making correlation searches run significantly faster than raw searches across indices.

Answer

Summary Indexing

Answer

Correlation Search Tuning

Answer

Lookup file generation

Question 17

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

Accepted Answer

Risk Data Model. While it can run on raw events, the Risk Analysis action is often used in correlation searches that monitor data models like 'Network Traffic' or 'Authentication'.

Answer

Vulnerability Data Model

Answer

Threat Intelligence Data Model

Answer

Endpoint Data Model

Question 18

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

Accepted Answer

Risk Analysis Dashboard. The Risk Analysis dashboard allows analysts to drill down into the specific risk events contributing to a user's total risk score.

Answer

Threat Activity Dashboard

Answer

Access Anomalies Dashboard

Answer

Incident Review

Question 19

You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?

Accepted Answer

Create a Notable Event Suppression entry.. Notable Event Suppression allows you to define specific filter criteria based on fields like host, user, or signature to ignore known false positives.

Answer

Lower the urgency of the notable event.

Answer

Modify the correlation search cron schedule.

Answer

Delete the scan data from the index.

Question 20

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Accepted Answer

Host/Asset context. The framework is primarily used to add context to users and hosts (assets).

Answer

Encrypted packet captures

Answer

Raw web server application logs

Answer

System performance statistics