SPLK-5001 Practice Test 21 — 15 Questions

Question 1

Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?

Accepted Answer

Threat Intelligence Manager.. The Threat Intelligence Manager dashboard in Splunk Enterprise Security is specifically designed to view, add, and manage threat intelligence feeds. It provides a centralized interface for configuring feeds, monitoring their status, and reviewing the threat objects they contain. This dashboard directly supports the threat intelligence framework, allowing analysts to enable or disable feeds and adjust settings.

Answer

Security Posture.

Answer

Asset and Identity.

Answer

Incident Review.

Question 2

You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?

Accepted Answer

Connectivity and credentials in the specific Add-on configuration.. When an Adaptive Response action fails to execute on a remote device, the first thing to check is connectivity and credentials in the specific add-on configuration, because Adaptive Response actions rely on the add-on to connect to the remote device using configured credentials. Without proper connectivity and valid credentials, the action cannot execute.

Answer

The indexer cluster master status.

Answer

The number of active users in Splunk.

Answer

The notable event retention policy.

Question 3

An analyst is investigating a potential DLL sideloading attack on a Windows host. Which Splunk ES data model and field can be used to detect the loading of a malicious DLL from an unusual path?

Accepted Answer

Endpoint data model, field dll_path. DLL sideloading involves a legitimate application loading a malicious DLL from an unexpected location. The Endpoint data model, populated by Sysmon Event ID 7 or similar, includes the dll_path field that records the loaded DLL's path. By analyzing dll_path for DLLs loaded from user-writable directories or unusual locations, analysts can detect sideloading attempts. Other data models lack the necessary file and process context.

Answer

Endpoint data model, field image_path

Answer

Identity_Management data model, field process_path

Answer

Network_Traffic data model, field file_path

Question 4

You are hunting for persistence via Windows scheduled tasks. You have Splunk ingesting Windows Event Logs and Sysmon. Which Event ID and field should you prioritize to detect a newly created scheduled task that runs a suspicious binary?

Accepted Answer

Event ID 4698 with TaskContent containing the binary path. Scheduled task creation is best detected via Windows Security Event ID 4698, which includes the full task definition in TaskContent. This allows you to inspect the executable path and arguments for suspicious binaries. Relying on process creation events may miss tasks created through other interfaces.

Answer

Event ID 4688 with NewProcessName

Answer

Event ID 106 with TaskName

Answer

Event ID 1 with CommandLine containing schtasks

Question 5

A security team is mapping its Splunk Enterprise Security (ES) detections to the MITRE ATT&CK framework. The team wants to identify all active detections that can detect adversary behavior related to credential dumping. Which Splunk ES feature should they use to view the MITRE ATT&CK techniques and the associated detections?

Accepted Answer

MITRE ATT&CK Dashboard. The MITRE ATT&CK Dashboard in Splunk ES is designed to map detections to adversary techniques. It allows security teams to filter by technique, such as Credential Dumping, and see which correlation searches are enabled and relevant. This directly supports the goal of identifying active detections for credential dumping, unlike other features that focus on threat intelligence, asset management, or incident triage.

Answer

Threat Intelligence Framework

Answer

Asset & Identity Framework

Answer

Incident Review

Question 6

A security analyst has created a new correlation search that generates notable events. After the search runs, the analyst notices that the notable events are not appearing in the Incident Review dashboard. The search itself returns results when run manually. Which configuration should the analyst verify first?

Accepted Answer

The correlation search's alert action settings.. When a correlation search runs but notables do not appear in Incident Review, the most common cause is that the 'Notable' alert action is not enabled or configured correctly. The alert action is responsible for writing the notable event to the appropriate index. Without it, the search results are not converted into notables. Verifying the alert action settings should be the first step before checking other configurations.

Answer

The user's role permissions.

Answer

The data model acceleration status.

Answer

The correlation search's cron schedule.

Question 7

An analyst is investigating a notable event in Splunk ES and needs to determine which correlation search generated it and what risk objects contributed to its creation. Which Splunk ES feature provides this information directly from the notable event?

Accepted Answer

The Incident Review dashboard's Event Details panel.. The Incident Review dashboard's Event Details panel is designed to show all relevant metadata for a notable event, including the correlation search that generated it and the risk objects that contributed to its risk score. This allows analysts to understand the detection logic and contributing entities without leaving the notable event context. Other options are either for enrichment, aggregate views, or general searching, and do not provide the direct linkage required.

Answer

The Search & Reporting app's default search view.

Answer

The Asset & Identity management interface.

Answer

The Risk Analysis dashboard's Risk Objects pane.

Question 8

While hunting for Kerberos-based attacks, you notice a service account requesting service tickets for many distinct SPNs across multiple servers within a short window. You want to correlate this with the account's normal baseline to confirm abnormal breadth. Which approach most directly supports that analysis in Splunk?

Accepted Answer

Run a search for EventCode 4769, then use eventstats to compute the average number of distinct service names per account over the prior 30 days and compare the current hour against that baseline. Kerberos service ticket requests are logged as EventCode 4769, and the hunt hinges on measuring how many distinct service names a given account requests relative to its own history. Attaching a per-account baseline with eventstats and comparing the current window exposes accounts whose SPN breadth suddenly expands, a pattern consistent with kerberoasting or misuse of a privileged service account.

Answer

Search EventCode 4776 and use stats values(user) by workstation to list accounts validated on each host

Answer

Search EventCode 4768 and use timechart to plot authentication ticket requests per account over 24 hours

Answer

Search EventCode 4624 and use transaction to group logon events by account, then count the number of source workstations per session

Question 9

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Accepted Answer

Splunk Case Management. Splunk Enterprise Security's Case Management feature lets analysts group related notables into a single investigation container, track status, assign owners, and document findings. It is designed specifically for organizing multiple notables that belong to the same incident. Aggregation, suppression, and filters do not create investigation containers.

Answer

Notable Event Aggregation

Answer

Notable Event Suppression

Answer

Incident Review Filters

Question 10

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the 'Weaponization' phase. Which activity would be most indicative of this phase?

Accepted Answer

An attacker creates a malicious document by embedding a macro that downloads a payload.. Weaponization is the phase where the adversary creates the malicious payload, such as a weaponized document or exploit. In Splunk ES, this phase is difficult to detect directly because it happens on adversary systems, but threat intelligence feeds can provide known malicious file hashes. Understanding this phase helps analysts prioritize prevention at the delivery stage.

Answer

A compromised host begins beaconing to a command and control server.

Answer

An attacker exfiltrates sensitive data from the network.

Answer

A user receives a phishing email with a malicious attachment.

Question 11

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

Accepted Answer

Incident Review. The Incident Review dashboard in Splunk Enterprise Security is the central analyst workspace that displays all notable events generated by correlation searches, including their urgency, status, owner, and disposition. It aggregates active notables requiring triage, allowing analysts to filter, assign, and investigate them. This is the primary dashboard referenced in ES for managing the notable event lifecycle.

Answer

Threat Intelligence

Answer

Security Posture

Answer

User Activity

Question 12

Which TWO of the following are examples of reconnaissance techniques used by attackers?

Accepted Answer

Domain footprinting. Domain footprinting (A) is a reconnaissance technique because it gathers information about a target organization's domains, subdomains, IP ranges, and DNS records using tools like WHOIS, nslookup, and dig, all without directly attacking the target. Port scanning (C) is also reconnaissance, as tools such as Nmap probe TCP/UDP ports to discover open services, running daemons, and potential entry points before exploitation. Both fall into the information-gathering phase of the attack lifecycle (e.g., MITRE ATT&CK Reconnaissance tactic). Password cracking (B) is an exploitation/credential-access activity, not reconnaissance, since it attempts to recover credentials from captured hashes. Log file deletion (D) is a defense-evasion and anti-forensics action performed after compromise. Data encryption (E) is a defensive or data-protection measure, not an attacker reconnaissance technique.

Answer

Password cracking

Answer

Log file deletion

Answer

Data encryption

Question 13

A security team is mapping their Splunk Enterprise Security detections to the MITRE ATT&CK framework. They want to identify techniques that adversaries use to maintain persistent access on compromised endpoints. Which MITRE ATT&CK tactic should they focus on first?

Accepted Answer

Persistence. Persistence is the correct tactic because it directly addresses the adversary's goal of maintaining a foothold on a compromised system. Detections such as unauthorized scheduled tasks, new services, or registry run key modifications are classic persistence techniques. Aligning these with the Persistence tactic in Splunk ES ensures accurate ATT&CK coverage reporting and focused threat hunting.

Answer

Defense Evasion

Answer

Credential Access

Answer

Privilege Escalation

Question 14

A security analyst wants to identify which users have logged in from more than one distinct country in the last 24 hours, a possible sign of credential compromise. The events contain user and src_country fields. Which SPL search best identifies these users?

Accepted Answer

index=auth action=success earliest=-24h | stats dc(src_country) as country_count by user | where country_count > 1. To find users logging in from multiple countries, the analyst must count distinct values of src_country per user. The stats command with the dc function computes exactly that distinct count, and the where clause filters to users with more than one. This approach is efficient, deterministic, and directly expresses the detection logic.

Answer

index=auth action=success earliest=-24h | dedup user, src_country | stats count by user | where count > 1

Answer

index=auth action=success earliest=-24h | transaction user | where mvcount(src_country) > 1

Answer

index=auth action=success earliest=-24h | stats count by user, src_country | where count > 1

Question 15

A security analyst is investigating a potential data exfiltration event. They need to calculate the rate of outbound data transfer per source IP over the last 30 minutes, but the raw logs only contain cumulative byte counts per connection. Which SPL command sequence correctly computes the per-second rate of change for each src_ip?

Accepted Answer

sort 0 _time | streamstats current=f window=2 last(bytes) as prev_bytes last(_time) as prev_time by src_ip | eval rate = (bytes - prev_bytes) / (_time - prev_time). To compute a per-second rate from cumulative counters, you need the difference in bytes and the difference in time between consecutive events. Sorting by time and using streamstats to fetch the previous values enables that calculation. The other options either compute a static average, reference non-existent fields, or omit the necessary time delta.

Answer

sort 0 _time | delta bytes as byte_delta by src_ip | eval rate = byte_delta / (_time - prev_time)

Answer

stats sum(bytes) as total_bytes by src_ip | eval rate = total_bytes / 1800

Answer

streamstats current=f window=2 sum(bytes) as total by src_ip | eval rate = (total - bytes) / (_time - prev_time)