SPLK-5001 Practice Exam 4 — 20 Questions

Question 1

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

Accepted Answer

The priority ranking in the Incident Review dashboard.. Urgency is a calculated value based on the risk of the event and the criticality of the assets involved, displayed in the Incident Review dashboard.

Answer

The frequency at which the search runs.

Answer

The retention period of the event.

Answer

The speed of the correlation search execution.

Question 2

Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?

Accepted Answer

The Search Head.. The 'Correlation Search' scheduler is the specific component that runs searches and triggers notable events.

Answer

The Forwarder.

Answer

The License Master.

Answer

The Indexer.

Question 3

In the context of Splunk ES, what is an 'Asset'?

Accepted Answer

An entity like a host or server.. An asset represents an entity in the environment, such as a host or server, which is stored in the asset and identity framework for context enrichment.

Answer

A malicious IP address.

Answer

A saved search report.

Answer

A notable event.

Question 4

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

Accepted Answer

It provides context to events.. It provides contextual information (like user departments or host ownership) to notable events, allowing for better prioritization and investigation.

Answer

It hides false positives.

Answer

It automatically generates risk scores.

Answer

It replaces the need for data models.

Question 5

Which THREE pieces of information are commonly found in a Splunk ES Case?

Accepted Answer

Investigation metadata (status, owner). Cases are containers that hold key artifacts, comments from analysts, and links to relevant notable events.

Answer

Raw indexer performance logs

Answer

System health metrics

Question 6

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Accepted Answer

Risk Message. The action allows configuration of the risk object, score, and message.

Answer

CPU core count

Answer

Network interface speed

Question 7

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

Accepted Answer

Set the TZ attribute in props.conf for the specific sourcetype.. Configuring the time zone in props.conf using TZ ensures that the _time field correctly reflects the event's actual time before correlation.

Answer

Modify the data model acceleration schedule.

Answer

Use an eval statement in the search to subtract hours.

Answer

Change the Splunk server time zone.

Question 8

What is the primary function of the 'Notable Event Suppression' feature?

Accepted Answer

To reduce alert fatigue from known false positives.. It allows users to prevent known false positives from creating notable events, reducing alert fatigue.

Answer

To automatically block malicious IPs.

Answer

To speed up correlation searches.

Answer

To archive old notable events.

Question 9

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

Accepted Answer

Severity. The dashboard displays core event information, including status and severity.

Answer

Raw file path

Answer

Cluster replication factor

Answer

License expiration date

Question 10

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

Accepted Answer

Use the 'owner' field in the notable event action configuration to map to an extracted user field.. The 'drilldown_field' and 'owner' field mapping in the notable event configuration allow for dynamic assignment based on extracted fields.

Answer

Assign the owner via a post-process lookup file.

Answer

Create separate correlation searches for each user.

Answer

Hardcode the owner name in the correlation search action.

Question 11

Which dashboard in Splunk ES provides a high-level view of threats and vulnerabilities mapped to the MITRE ATT&CK framework?

Accepted Answer

Security Posture.. The Security Posture dashboard and the MITRE ATT&CK mapping dashboard are standard features for viewing framework coverage.

Answer

Asset Discovery.

Answer

Threat Intelligence Manager.

Answer

Incident Review.

Question 12

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Accepted Answer

The 'Notable' adaptive response action is not enabled in the search configuration.. The 'Notable' adaptive response action must be enabled in the correlation search configuration for it to generate an entry in the Incident Review dashboard.

Answer

The correlation search schedule is set to 'Real-time'.

Answer

The user does not have the 'ess_admin' role.

Answer

The data model acceleration is lagging.

Question 13

You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?

Accepted Answer

spath input=raw_data. The 'spath' command is specifically designed to parse JSON or XML data.

Answer

eval json_parse(raw_data)

Answer

json raw_data

Answer

extract json raw_data

Question 14

Which command is used to remove duplicate events based on a field?

Accepted Answer

dedup event_id. The 'dedup' command is specifically for removing duplicates.

Answer

remove_duplicates event_id

Answer

distinct event_id

Answer

unique event_id

Question 15

Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?

Accepted Answer

Submit the hash to an external sandbox/reputation service. Checking against threat intelligence and using online reputation services are standard methods.

Answer

Restart the endpoint

Answer

Rename the file

Answer

Change the file extension

Question 16

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Accepted Answer

Select the event in Incident Review and choose 'Add to Case'.. From the Incident Review dashboard, analysts can select a notable event and use the 'Action' menu to assign it to an existing case.

Answer

Edit the correlation search definition.

Answer

Modify the risk index directly.

Answer

Use the Case Management dashboard to search for the event ID.

Question 17

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

To triage and manage notable events.. It serves as the central hub for security analysts to triage, investigate, and manage notable events.

Answer

To manage threat intelligence feeds.

Answer

To configure data model acceleration.

Answer

To view real-time system health.

Question 18

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Accepted Answer

Correlation Search Editor. Risk rules are often defined within the correlation search itself, where the risk score is mapped to the event severity.

Answer

Identity Manager

Answer

Risk Index Configuration

Answer

Risk Notable Settings

Question 19

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Accepted Answer

Correlation Search Suppression. Notable event suppression is the native method in Splunk ES to prevent specific event types from triggering notables based on criteria.

Answer

Risk Index Retention Policy

Answer

Data Model Acceleration

Answer

Asset and Identity Table

Question 20

Which TWO factors are critical for effective Asset and Identity enrichment?

Accepted Answer

The consistency of the source data files.. The quality of the input data (CSV/KV Store) and the accuracy of the matching fields (like IP or user) are critical.

Answer

The physical location of the Splunk indexer.

Answer

The number of colors used in the dashboard.

Answer

The version of the OS running on the search head.