SPLK-5001 Practice Test 22 — 15 Questions

Question 1

You are conducting a threat hunt for data exfiltration over DNS. Which TWO Splunk search techniques are most effective for identifying anomalous DNS tunneling activity in your DNS logs? (Choose two.)

Accepted Answer

Use the eventstats command to compute the standard deviation of query counts per host and alert on hosts exceeding three standard deviations.. DNS tunneling hides data in long, high-entropy subdomains and generates abnormal query volumes. Statistical profiling of query length and query count per host identifies deviations from normal DNS behavior without relying on known indicators. These techniques are proactive and can detect new tunneling domains.

Answer

Count the number of unique source IPs per DNS server and alert when the count exceeds a fixed threshold of 100.

Answer

Filter for DNS query types A and AAAA only, then sort by query name alphabetically.

Answer

Search for DNS queries containing the string 'malware' in the query name.

Question 2

A SOC manager is defining a new risk-based alerting strategy and wants to ensure that risk events generated by correlation searches are properly attributed and actionable. Which TWO fields are required in a risk event for the Risk Analysis framework to correctly associate risk with an entity and contribute to its score? (Choose two.)

Accepted Answer

risk_object_type. For the Risk Analysis framework to associate a risk event with an entity and update its score, the event must include risk_object and risk_object_type. These fields identify the entity and its category. Other fields like risk_score, risk_message, and risk_severity are useful but optional for the association to occur.

Answer

risk_message

Answer

risk_score

Answer

risk_severity

Question 3

An analyst notices a Splunk ES notable event indicating a possible DNS exfiltration. In the Network_Traffic data model, which field contains the domain name being queried by an internal host?

Accepted Answer

dns_query. The Network_Traffic data model includes the dns_query field specifically for DNS request events. When investigating DNS exfiltration, analysts must examine the queried domain names, which are stored in dns_query. This field allows detection of anomalous patterns such as long, random subdomains used to tunnel data. Other fields like dest_host or url do not capture the DNS query string and would lead to missed detection.

Answer

query

Answer

dest_host

Answer

url

Question 4

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

Accepted Answer

Web. The Web data model in Splunk's Common Information Model (CIM) contains information about web activity, including HTTP user-agents and request methods. It is designed to capture web server and web proxy logs, making it the correct choice for investigating web-based attacks.

Answer

Network Traffic

Answer

Authentication

Answer

Endpoint

Question 5

You are preparing a hunt for suspicious PowerShell execution and want to search only the accelerated data model rather than raw events to return results faster across a large environment. Which Splunk construct should you use?

Accepted Answer

The tstats command against the Endpoint data model with the Processes dataset. Accelerated data models exist precisely so that high-volume hunts can run quickly over summarized data. The tstats command is the purpose-built tool for querying those models, and the Endpoint data model's Processes dataset holds the process name, command line, and parent process fields needed to find suspicious PowerShell execution. Using it keeps the hunt fast and repeatable across a large estate.

Answer

The pivot interface filtered to the Processes dataset

Answer

The datamodel command with the search clause to filter Process events

Answer

The from command reading the Endpoint.Processes dataset directly

Question 6

What is the primary function of the 'Notable Event Suppression' feature?

Accepted Answer

To reduce alert fatigue from known false positives.. Notable Event Suppression in Splunk ES lets analysts suppress future notables that match specified fields (e.g., same src, dest, rule name) for a defined period. Its primary purpose is to reduce alert fatigue by filtering out known false positives or already-investigated recurring activity, so the SOC focuses on genuinely new threats. Suppression does not block traffic or modify correlation search performance.

Answer

To automatically block malicious IPs.

Answer

To speed up correlation searches.

Answer

To archive old notable events.

Question 7

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

Accepted Answer

It provides context to events.. The Asset and Identity framework in Splunk ES enriches events with contextual information such as asset owner, priority, category, and identity details (e.g., department, role). This context helps analysts quickly understand the who, what, and where of an event, prioritize investigations, and make faster decisions. It does not hide false positives, automatically generate risk scores, or replace data models.

Answer

It hides false positives.

Answer

It automatically generates risk scores.

Answer

It replaces the need for data models.

Question 8

A SOC analyst is reviewing a notable event for a suspected compromised host. The analyst wants to enrich the investigation by viewing the raw event that triggered the detection, along with the associated risk events and threat intelligence matches, directly from the notable event in Splunk Enterprise Security. Which feature should the analyst use to access this consolidated context?

Accepted Answer

Incident Review. Incident Review is designed for investigating notables and provides a unified view of the raw event, risk events, and threat intelligence. It enables analysts to pivot to related evidence, which is essential for effective triage. The other options are supporting features but do not offer the consolidated investigative context required.

Answer

Threat Intelligence Framework

Answer

Asset & Identity Management

Answer

Risk Analysis Dashboard

Question 9

You are hunting for suspicious PowerShell activity on endpoints. You have PowerShell Script Block Logging (Event ID 4104) ingested into Splunk. Which search best identifies scripts that download and execute remote content, a common attacker technique?

Accepted Answer

index=win EventCode=4104 | where like(ScriptBlockText, "%DownloadString%") OR like(ScriptBlockText, "%Invoke-Expression%"). PowerShell Script Block Logging (4104) records the actual script text. Attackers frequently use DownloadString to fetch remote payloads and Invoke-Expression to execute them. Searching for these strings directly identifies the download-and-execute chain, which is a high-fidelity indicator of malicious PowerShell activity.

Answer

index=win EventCode=4103 | stats count by ScriptBlockText

Answer

index=win EventCode=4104 | regex ScriptBlockText="^[A-Za-z0-9+/=]{100,}$"

Answer

index=win EventCode=4104 | where like(ScriptBlockText, "%Get-Process%")

Question 10

A security analyst is reviewing an incident where an attacker used the technique 'T1071.001 - Application Layer Protocol: Web Protocols' for command and control. The analyst needs to identify which data sources in Splunk ES would be most effective for detecting this activity. Which of the following data sources should be prioritized?

Accepted Answer

Web proxy logs and DNS logs. Web proxy logs and DNS logs provide the application-layer visibility needed to detect T1071.001, which relies on HTTP/HTTPS for command and control. Proxy logs show the actual web requests, including URLs and user agents, while DNS logs can reveal domain resolutions to known C2 infrastructure. Splunk ES can ingest these sources and apply threat intelligence matching or behavioral analytics to identify malicious web traffic.

Answer

Firewall logs and NetFlow data

Answer

Endpoint detection and response (EDR) telemetry

Answer

Authentication logs and Windows Security event logs

Question 11

Which TWO of the following are valid methods for enriching notable events in Splunk ES?

Accepted Answer

Configuring the Asset and Identity framework.. Option D is correct because the Asset and Identity framework in Splunk ES enriches notable events by automatically appending asset and identity metadata (such as priority, category, owner, and business unit) to events based on IP, MAC, or user lookups, which directly enhances the context of notable events. Option E is correct because automatic lookup definitions (configured in props.conf and transforms.conf) perform lookup-based field enrichment at search time, appending metadata such as asset or identity attributes to events, which is a standard mechanism for enriching notable events in ES. Option A is incorrect because disabling real-time alerts only stops alert generation and does not add any contextual data to notable events. Option B is incorrect because extending a correlation search's time range affects when and how often the search runs, not the enrichment of the resulting notable events. Option C is incorrect because changing the indexer cluster replication factor is a data-availability and resilience setting and has no bearing on event enrichment.

Answer

Disabling real-time alerts.

Answer

Increasing the search time range of the correlation search.

Answer

Modifying the indexer cluster replication factor.

Question 12

A healthcare SOC is preparing an executive briefing that maps its Splunk Enterprise Security detections to the NIST Cybersecurity Framework 2.0. The CISO specifically asks which function covers activities such as establishing policies, defining roles, and performing risk assessments before any incident occurs. Which NIST CSF 2.0 function should the analyst cite for these governance and risk-management activities?

Accepted Answer

GOVERN (GV). NIST CSF 2.0 introduced the GOVERN function to elevate cybersecurity risk management to organizational governance, covering policy, roles, responsibilities, and risk strategy. Because the CISO described policy creation, role definition, and pre-incident risk assessment rather than asset inventory or safeguards, the governance-oriented function is the accurate mapping for the briefing.

Answer

IDENTIFY (ID)

Answer

RESPOND (RS)

Answer

PROTECT (PR)

Question 13

An analyst in Splunk Enterprise Security is investigating a suspected Kerberoasting attack. They notice multiple Event Code 4769 events where the ticket encryption type is 0x17 and the service name is not a known service account. Which Splunk search would best identify the affected user accounts and the targeted service principal names (SPNs)?

Accepted Answer

index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17 | stats count by Account_Name, Service_Name. To detect Kerberoasting, analysts focus on Event Code 4769, which logs Kerberos service ticket requests. Attackers often request service tickets with RC4 encryption (0x17) because it is weaker and easier to crack offline. Aggregating by Account_Name and Service_Name reveals which users are requesting tickets for which services, highlighting suspicious patterns such as a single user requesting many service tickets or tickets for unusual SPNs.

Answer

index=wineventlog EventCode=4771 | stats count by Account_Name, Service_Name

Answer

index=wineventlog EventCode=4624 Logon_Type=3 | stats count by Account_Name, Workstation_Name

Answer

index=wineventlog EventCode=4768 Ticket_Encryption_Type=0x17 | stats count by Account_Name, Service_Name

Question 14

A retail company's SOC uses Splunk Enterprise Security to enrich alerts with threat intelligence. The intelligence lead wants to categorize feeds so analysts know whether an indicator is a raw observable, contextual reporting about an actor, or a confirmed malicious indicator. Which model should the analyst use to classify these feeds as strategic, operational, tactical, or technical intelligence?

Accepted Answer

The threat intelligence tier model (strategic, operational, tactical, technical). Threat intelligence is commonly organized into strategic, operational, tactical, and technical tiers based on audience and content. Strategic informs leadership decisions, operational describes campaigns and intent, tactical captures TTPs, and technical delivers machine-consumable observables such as hashes and domains. This tier model is what allows the intelligence lead to label feeds consistently inside an enrichment workflow.

Answer

The Diamond Model of Intrusion Analysis

Answer

The Cyber Kill Chain

Answer

The MITRE ATT&CK Enterprise matrix

Question 15

A security analyst needs to create a correlation search that detects when a user account is locked out and then successfully logs in within 10 minutes. The analyst wants to ensure that the search does not generate duplicate notable events for the same user within a 24-hour period. Which Splunk Enterprise Security feature should the analyst use to achieve this?

Accepted Answer

Alert suppression with suppression fields set to user and a suppression period of 24 hours.. Alert suppression in Splunk Enterprise Security is designed to prevent duplicate notable events based on specified fields and a suppression period. By setting the suppression field to user and the period to 24 hours, the analyst ensures that once a notable is created for a user, no additional notables for that user are generated within the next 24 hours, even if the correlation search triggers again.

Answer

Using the `dedup` command in the search to remove duplicate events.

Answer

Throttling the correlation search to run only once every 24 hours.

Answer

Configuring the correlation search to use a 24-hour time range.