SPLK-5001 Practice Exam 4 — 20 Questions

Question 1

An analyst notices a Windows workstation repeatedly resolving long, random-looking subdomains under a single parent domain, followed by outbound DNS TXT queries. Which Splunk ES detection method is most appropriate to identify this as DNS tunneling?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Network_Traffic data model with a search that aggregates the length of DNS query names and the count of unique subdomains per parent domain, then apply a threshold-based correlation search.. DNS tunneling encodes data in query names and record types, producing long, random-looking subdomains and frequent TXT queries to one parent domain. The Network_Traffic data model holds DNS events and supports aggregation of query name length and unique subdomain counts per parent, making a threshold-based correlation search the reliable way to flag this behavior.

Answer

Use the Endpoint data model to look for process execution of signed system binaries that spawn child processes outside their normal parent.

Answer

Use the Authentication data model to count failed logons per hour and trigger an alert when the count exceeds a baseline.

Answer

Use the Web data model to search for HTTP POST requests containing base64-encoded parameters sent to a small set of external IPs.

Question 2

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Accepted Answer

Host/Asset context. The Asset and Identity framework in Splunk ES is designed to correlate events with contextual metadata about hosts and users, so option A (Host/Asset context) is correct because it enriches events with asset attributes such as IP, MAC, hostname, priority, and business unit. Option C (User identity information) is also correct because the framework enriches events with identity attributes like user name, email, department, and role, enabling risk scoring and correlation. Options B, D, and E are not part of the framework's enrichment: encrypted packet captures are raw network data, raw web server application logs are source events rather than enrichment lookups, and system performance statistics are metrics not typically provided by asset or identity lookups.

Answer

Encrypted packet captures

Answer

Raw web server application logs

Answer

System performance statistics

Question 3

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

Accepted Answer

The priority ranking in the Incident Review dashboard.. In Splunk Enterprise Security, the 'Urgency' field on a notable event is a normalized severity indicator (informational, low, medium, high, critical) that drives the priority ranking and sort order within the Incident Review dashboard. It is populated by the correlation search's adaptive response action (e.g., 'risk' or 'notable' action) based on the 'urgency' argument set in the saved search. It does not affect scheduling, retention, or execution speed — those are governed by other settings.

Answer

The frequency at which the search runs.

Answer

The retention period of the event.

Answer

The speed of the correlation search execution.

Question 4

What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?

Accepted Answer

It determines how long data remains in the Notable event storage.. The Retention Period setting in Splunk Enterprise Security controls how long notable events and their associated metadata are retained in the notable event storage (the KV Store-backed index). Changing it adjusts the lifespan of these records before they are purged, directly affecting how far back analysts can review or investigate prior notables. It does not affect raw data retention, licensing, or user permissions.

Answer

It changes the user access level.

Answer

It changes the search speed.

Answer

It increases the license limit.

Question 5

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Accepted Answer

Select the event in Incident Review and choose 'Add to Case'.. In Splunk Enterprise Security, the Incident Review dashboard is the primary triage interface where analysts view notable events and can take actions on them. To manually add an event to an existing case, the analyst selects the event within Incident Review and uses the 'Add to Case' action, which associates that event with the chosen case for investigation. This is the documented, supported workflow for enriching a case with additional evidence.

Answer

Edit the correlation search definition.

Answer

Modify the risk index directly.

Answer

Use the Case Management dashboard to search for the event ID.

Question 6

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

Accepted Answer

To align with attacker dwell time. The primary purpose of a 'Lookback' period in threat hunting is to align with attacker dwell time, which is the time an attacker remains undetected in a network. By setting a lookback period that covers the typical dwell time, hunters can search for indicators of compromise over a relevant historical window, increasing the chances of detecting ongoing or past intrusions.

Answer

To increase the search speed

Answer

To clear the cache

Answer

To reduce the number of false positives

Question 7

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

Accepted Answer

Correlation Search Editor. The Correlation Search Editor is the ES component used to create, edit, and manage correlation searches, including those that match events against a custom blacklist of domains. You define the search logic, schedule, throttling, and notable event settings here. It is the correct place to author a new rule that leverages a lookup or KV Store blacklist for domain matching.

Answer

Notable Event Suppressor

Answer

Risk Analysis Configuration

Answer

Threat Intelligence Framework

Question 8

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

Accepted Answer

dest. The Splunk Common Information Model (CIM) standardizes field names to enable consistent searching and reporting across diverse data sources. For network traffic data models, the CIM specifies 'dest' as the canonical field for the destination IP address. This normalization allows analysts to write a single search (e.g., `| tstats ... where nodename=All_Traffic`) that works regardless of whether the underlying source used 'dst_ip', 'remote_address', or 'target_ip'. Option C is correct because 'dest' is the exact field name defined in the CIM's Network Traffic data model.

Answer

dst_ip

Answer

remote_address

Answer

target_ip

Question 9

What is the result of using 'bin _time span=1d'?

Accepted Answer

Groups events into 24-hour buckets.. The 'bin _time span=1d' command groups events into 24-hour buckets based on the _time field, effectively discretizing timestamps into daily intervals. It does not count events by itself; it creates a binned _time field that can then be used with stats, timechart, or other aggregations. The result is that events are assigned to day-long buckets for grouping.

Answer

Counts events per day.

Answer

Deletes events older than 1 day.

Answer

Changes the display format of the timestamp.

Question 10

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

Accepted Answer

Correlation Search Editor. The Correlation Search Editor is where you configure all aspects of a correlation search, including its risk score (risk analysis settings) and urgency. Adjusting the sensitivity of a specific correlation search means editing its risk score or risk object configuration, which is done in this editor. It provides the per-search control needed to tune detection sensitivity.

Answer

Notable Event Settings

Answer

Incident Review

Answer

Risk Analysis Dashboard

Question 11

During a hunt for compromised accounts, you want to distinguish a legitimate helpdesk password reset from an attacker resetting credentials to retain access. Which correlation of events in Splunk would best support that distinction?

Accepted Answer

Correlate Event ID 4724 (password reset attempt) with the initiating account and compare the target account's subsequent logon source IPs against its historical baseline. Password reset activity is captured by Event ID 4724, which includes the account performing the reset. The key discriminator is what happens next: if the target account subsequently authenticates from source addresses outside its historical pattern, the reset likely served attacker access retention rather than routine support. Correlating the reset actor with the target's later logon geography turns a benign-looking event into a defensible finding.

Answer

Correlate Event ID 4688 process creation with Event ID 5156 network connection allowed and group by parent process

Answer

Correlate Event ID 4768 with Event ID 4769 and count ticket requests per account within a five-minute window

Answer

Correlate Event ID 4624 logon type 3 with Event ID 4672 special privileges assigned and group by destination host

Question 12

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

Accepted Answer

The search logic does not match the data.. A correlation search that runs successfully but returns 0 results indicates the search's filtering conditions (e.g., field values, thresholds, time windows, or index/sourcetype references) don't match any events in the data. Since the search executes without error, the issue is with the logic-to-data alignment, not infrastructure or permissions.

Answer

The Splunk indexer is overloaded.

Answer

The user does not have permission to write to the risk index.

Answer

The Risk Analysis action is disabled.

Question 13

You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?

Accepted Answer

The input configuration within the Splunk Add-on for Microsoft Windows.. The Splunk Add-on for Microsoft Windows (TA-windows) contains the field extractions, event type definitions, and CIM-compliant tag mappings that normalize Windows Event Log data (e.g., EventCode 4624, 4625) into the Authentication data model's required fields like src, user, dest, and action. Sourcetype configuration and CIM tagging for Windows events are handled at the input/props level within this add-on, so it is the primary place to ensure data conforms to the CIM.

Answer

The data model acceleration settings in the ES app settings.

Answer

The index-time index routing configuration in indexes.conf.

Answer

The Notable Event Suppression configuration in Splunk ES.

Question 14

Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?

Accepted Answer

Search Macro. A Search Macro in Splunk allows you to save a search query with variables (arguments) that can be reused across different searches, time ranges, and entities. It supports parameterization, enabling analysts to define placeholders that are replaced at runtime, making it ideal for reusable and dynamic searches.

Answer

Saved Search

Answer

Data Model Acceleration

Answer

Event Type

Question 15

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

Accepted Answer

The scores are additive.. When the Risk Analysis framework uses the 'sum' aggregation method, risk scores from multiple risk events for the same object within the same time window are added together. This additive behavior means an object with three risk events scoring 20, 30, and 50 would have a total risk score of 100 for that window.

Answer

Only the highest score is kept.

Answer

The scores are averaged.

Answer

The risk score is reset to zero.

Question 16

When using 'stats', how can you include the values of a field as columns in your output?

Accepted Answer

stats count by host, sourcetype | xyseries host, sourcetype, count. The xyseries command converts the results of a stats aggregation into a matrix (pivot) format, using one field for rows, another for column headers, and a numeric field for cell values. In this case, 'stats count by host, sourcetype' produces rows of (host, sourcetype, count), and 'xyseries host, sourcetype, count' pivots sourcetype values into distinct columns with counts as cell values. This is the canonical SPL way to turn grouped stats output into a wide table with field values as column headers.

Answer

stats count by host, sourcetype

Answer

stats count by host | transpose

Answer

stats pivot host sourcetype

Question 17

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

Accepted Answer

Enable acceleration and define a summary range.. To use a data model for notable event generation in ES, you must enable acceleration and define a summary range, because ES correlation searches rely on accelerated data models for performance. Acceleration creates summary data that the data model can query quickly, and the summary range determines how far back the summaries are retained.

Answer

Configure the data model to use only indexed fields.

Answer

Set the data model to root-level permissions only.

Answer

Manually create tags for every field in the data model.

Question 18

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

Accepted Answer

Event ID 1. Sysmon Event ID 1 is the 'Process Create' event, which logs the full command line, image path, parent process, user, and hashes for every process launched. For detecting living-off-the-land techniques (e.g., powershell.exe, wmic.exe, certutil.exe with suspicious arguments), Event ID 1 is the definitive source for command-line arguments.

Answer

Event ID 7

Answer

Event ID 2

Answer

Event ID 5

Question 19

When dealing with multi-value fields, which command allows you to break them into individual events?

Accepted Answer

mvexpand field_name. The mvexpand command takes a multi-value field and expands each value into its own separate event, duplicating the other fields for each value. This is the standard SPL command for breaking multi-value fields into individual events, and it is commonly used before further aggregation or correlation.

Answer

expand field_name

Answer

mv_to_events field_name

Answer

split field_name

Question 20

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

Accepted Answer

Hunt Procedure and Query Logic. The Hunt Procedure and Query Logic section documents the exact steps, SPL queries, data sources, and expected outputs of the hunt. This is what makes the playbook repeatable by another analyst and auditable later, because it captures the reproducible method rather than just the outcome. Without it, the playbook is not a procedure.

Answer

Threat Intelligence Source List

Answer

Executive Summary

Answer

Hardware Requirements