SPLK-5001 Practice Test 2 — 25 Questions

Question 1

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Accepted Answer

The 'notable' index logs.. The 'notable' index logs (A) are useful because correlation searches generate notable events that are written to the notable index, so inspecting it reveals whether the search fired and what it produced. scheduler.log (C) is essential because it records the scheduling of correlation searches, including skipped, deferred, or failed runs and any errors thrown during execution. The Search Job Inspector (E) is useful because it exposes the exact SPL executed, search duration, and detailed execution costs/errors, helping pinpoint why a correlation search misbehaves. The Splunk License usage report (B) only shows indexing volume against license limits and does not diagnose search logic or scheduling failures, and the user's web browser cache (D) is a client-side artifact unrelated to server-side correlation search execution.

Answer

The Splunk License usage report.

Answer

The user's web browser cache.

Question 2

A security analyst is reviewing the Incident Review dashboard in Splunk ES and wants to add a new field to the table that displays notable events. The field, 'src_ip', is already present in the notable event's raw data but not displayed. What should the analyst do to make this field visible in the Incident Review table?

Accepted Answer

Configure the 'Incident Review - Table Attributes' settings in Splunk ES to include 'src_ip'.. The Incident Review table attributes are configurable through Splunk ES settings. Adding 'src_ip' to the list of attributes will make it appear as a column in the Incident Review dashboard, allowing analysts to see the source IP directly without altering the correlation search or creating custom dashboards.

Answer

Edit the correlation search to include 'src_ip' in the search results and re-run it.

Answer

Modify the Incident Review dashboard's table settings to add 'src_ip' as a column.

Answer

Create a new dashboard that queries notable events and includes 'src_ip'.

Question 3

An analyst needs to review firewall traffic but only for events where the action field is explicitly 'blocked' and the bytes_out field is greater than 5000. Some events are missing the action field entirely. Which SPL search returns only events that satisfy both conditions?

Accepted Answer

index=firewall action=blocked bytes_out>5000. In SPL, multiple search terms typed into the base search are implicitly combined with AND logic. Writing action=blocked bytes_out>5000 therefore requires both field conditions to be true for an event to be returned. Because events missing the action field cannot satisfy action=blocked, they are silently dropped, which matches the requirement to review only complete, explicitly blocked high-volume traffic.

Answer

index=firewall action=blocked OR bytes_out>5000

Answer

index=firewall action=blocked NOT bytes_out>5000

Answer

index=firewall action=blocked bytes_out<5000

Question 4

A security analyst notices that a correlation search configured to detect multiple failed logins across the organization is not triggering notable events, even though the raw events are searchable. The correlation search uses the Authentication data model. Upon investigation, the analyst finds that the Authentication data model is not accelerated. What is the most likely reason the correlation search is failing to generate notables?

Accepted Answer

The correlation search requires the Authentication data model to be accelerated to efficiently retrieve and correlate events, and without acceleration, it may time out or return no results.. The Authentication data model must be accelerated for correlation searches to efficiently query it. Without acceleration, the search may time out or return incomplete results, preventing notable event creation. Acceleration builds summaries that speed up searches, which is essential for timely detection in Splunk ES.

Answer

The correlation search is configured to run in real-time mode, which is disabled for accelerated data models.

Answer

The correlation search is missing the 'action.notable' alert action, so it cannot create notable events.

Answer

The correlation search's cron schedule is set to run only during off-peak hours, so it hasn't executed yet.

Question 5

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Accepted Answer

Risk Message. In the Risk Analysis adaptive response action, the Risk Object (D) specifies which entity type the risk is applied to, such as a user, host, or IP address, making it a required configurable field. The Risk Score (C) sets the numeric risk value (typically 0–100) that the action assigns to that object, which is the core purpose of the action. The Risk Message (B) provides a descriptive text string explaining why the risk was assigned, and it is also configurable within the action. CPU core count (A) and network interface speed (E) are hardware/resource parameters unrelated to risk analysis and cannot be set in this adaptive response action.

Answer

CPU core count

Answer

Network interface speed

Question 6

Which command is used to rename a field in the results table for better readability?

Accepted Answer

rename src_ip as "Source Address". The rename command is specifically designed to rename fields in search results, and the syntax 'rename src_ip as "Source Address"' correctly renames the field src_ip to "Source Address" for display purposes. This is the standard SPL way to improve readability of field names in tables.

Answer

table src_ip as "Source Address"

Answer

fields src_ip:"Source Address"

Answer

eval "Source Address" = src_ip

Question 7

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

Accepted Answer

file_hash. The file_hash field in a Splunk ES notable event contains the hash (MD5/SHA) of the file involved in the detection, which is the primary pivot key for the File domain investigation dashboard. That dashboard is designed to look up file reputation, sandbox results, and endpoint activity by hash, making file_hash the most effective field for pivoting there.

Answer

src_user

Answer

signature

Answer

dest_port

Question 8

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration event. They need to determine which MITRE ATT&CK tactic describes the adversary's objective of stealing data from the compromised network. Which tactic should they reference?

Accepted Answer

Exfiltration. Exfiltration is the correct ATT&CK tactic for data theft. It encompasses techniques like exfiltration over C2 channel, exfiltration over alternative protocol, and exfiltration over physical medium. In Splunk ES, analysts should look for correlation searches that detect anomalous outbound data volumes or connections to known malicious IPs, and ensure these are tagged with the Exfiltration tactic for accurate reporting.

Answer

Collection

Answer

Impact

Answer

Command and Control

Question 9

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

Accepted Answer

The value added to the object's risk score.. In the Risk Analysis adaptive response, the 'risk_score' parameter specifies the numeric value that will be added to the risk score of the object (user, system, or other entity) associated with the notable event. It is the incremental contribution of that specific risk event, not the object's total score or a threshold.

Answer

The severity level of the notable event.

Answer

The threshold for triggering a notable.

Answer

The total risk score for the object.

Question 10

A SOC manager wants to review the overall risk posture of the organization by examining the highest-risk users and systems over the past week. Which Splunk Enterprise Security dashboard provides this aggregated view of risk objects and their scores?

Accepted Answer

Risk Analysis. The Risk Analysis dashboard is designed to display risk scores aggregated by risk object, such as users and systems. It allows security managers to quickly identify which entities have the highest accumulated risk, providing a clear view of organizational risk posture over a selected time range.

Answer

Incident Review

Answer

Security Posture

Answer

Threat Activity

Question 11

A SOC manager is aligning Splunk Enterprise Security with the NIST Cybersecurity Framework. They need to ensure that the 'Respond' function is properly supported. Which Splunk ES feature is specifically designed to facilitate the 'Respond' function by automating actions such as blocking IPs or disabling users?

Accepted Answer

Adaptive Response. Adaptive Response is the Splunk ES feature that directly supports the NIST CSF Respond function by enabling automated and manual actions on notable events. It allows analysts to execute scripts, block IPs, disable users, and more, thereby containing threats rapidly. This aligns with the Respond function's objectives of containment, mitigation, and improvement.

Answer

Incident Review

Answer

Threat Intelligence Framework

Answer

Risk Analysis

Question 12

An analyst is reviewing a notable event for a potential malware infection on a Windows endpoint. The event includes a file hash. To determine if the file is known malicious, the analyst wants to check its reputation using Splunk ES's threat intelligence framework. Which action should the analyst take?

Accepted Answer

Search the file hash in the Threat Intelligence data model to see if it matches any threat intel sources.. Splunk ES integrates threat intelligence feeds into the Threat Intelligence data model. By searching for the file hash there, the analyst can quickly see if it matches any known malicious indicators. The other options focus on endpoint activity or manual lists, which do not provide the same breadth of reputation data from multiple sources.

Answer

Run a search against the Endpoint data model to find all processes that executed the file hash.

Answer

Check the 'File Hash' field in the Malware data model to see if it is associated with any known malware families.

Answer

Use the 'threatlist' lookup to manually add the hash and then check if it appears in any notable events.

Question 13

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Accepted Answer

Scanning external IP ranges for open ports.. Reconnaissance in the Cyber Kill Chain involves information gathering and scanning to identify potential targets. Scanning external IP ranges for open ports is a classic reconnaissance activity, as it helps attackers map the attack surface. The other options represent later stages: spear-phishing is delivery, encryption for ransom is actions on objectives, and installing a backdoor is installation.

Answer

Sending a spear-phishing email.

Answer

Encrypting user files for ransom.

Answer

Installing a backdoor on a web server.

Question 14

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Accepted Answer

Change Analysis. The Change Analysis data model in Splunk ES tracks changes to system configurations, including audit log clears and service changes. Clearing the Windows Security Event log generates Event ID 1102 (or 104 for older systems), which the Change Analysis data model captures as a change event, making it the correct detection source.

Answer

Endpoint

Answer

Network Traffic

Answer

Authentication

Question 15

An analyst is investigating a suspected credential dumping attack on a Windows host. They want to identify evidence of this activity in Splunk ES. Which TWO of the following are valid indicators of credential dumping that can be found in Splunk ES data? (Choose two.)

Accepted Answer

Presence of a file named “lsass.dmp” in a temp directory. Credential dumping involves extracting credentials from memory or files. Access to lsass.exe with suspicious access rights indicates an attempt to read its memory, where credentials are stored. The creation of a file named lsass.dmp is a direct artifact of dumping the lsass process memory. Both indicators are observable in Splunk ES via endpoint data models and are strong evidence of credential dumping activity.

Answer

Anomalous number of failed logon attempts

Answer

Creation of a new service with a random name

Answer

Unexpected modification of the hosts file

Question 16

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Accepted Answer

Email gateway logs and web proxy logs.. The Delivery phase of the Cyber Kill Chain covers how the attacker transmits the weaponized payload to the victim — typically via email attachments, malicious links, or drive-by downloads. Email gateway logs capture delivery attempts (attachments, sender reputation, URL clicks), and web proxy logs capture drive-by download and malicious URL access. These two sources are the primary telemetry for correlating alerts to the Delivery stage.

Answer

Domain Controller authentication logs.

Answer

Internal host process creation logs.

Answer

Endpoint file integrity monitoring.

Question 17

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

Accepted Answer

The 'Authentication' Data Model.. Lateral movement in MITRE ATT&CK involves an adversary moving from one host to another, which is detected in Splunk ES primarily through authentication activity — logons, remote service creation, and credential use across systems. The Authentication data model normalizes logon/logoff, privilege escalation, and related events, and ES correlation searches for lateral movement (e.g., 'Detect Lateral Movement' or 'Excessive Authentication Failures') rely on it. Without the Authentication data model populated and accelerated, those detections cannot fire.

Answer

The 'Network Resolution' Data Model.

Answer

The 'Vulnerability' Data Model.

Answer

The 'Malware' Data Model.

Question 18

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

Accepted Answer

Asset Investigator. The Asset Investigator dashboard in Splunk ES provides a consolidated view of assets, including their criticality, identity, and associated risk. It is the primary place to see assets categorized by business criticality and to pivot into asset-specific investigation. This matches the requirement of summarizing all assets by criticality.

Answer

Threat Activity

Answer

User Activity

Answer

Access Anomalies

Question 19

During an investigation, an analyst needs to correlate a series of authentication failures with subsequent successful logins from the same source across multiple indexers. Which Splunk Enterprise Security capability is most appropriate for this task?

Accepted Answer

The Authentication data model, which normalizes authentication events and supports pivoting across users, sources, and outcomes.. The Authentication data model normalizes authentication events from diverse sources into a consistent schema with fields for user, source, action, and outcome. This allows analysts to correlate failed and successful authentications from the same source across multiple indexers. It is purpose-built for authentication investigations, unlike network, risk, or web data models that serve different analytic needs.

Answer

The Network Traffic data model, which captures sessions and can reveal authentication attempts embedded in network flows.

Answer

The Risk data model, which aggregates risk events and can show whether authentication failures contributed to an entity's score.

Answer

The Web data model, which captures HTTP activity and can include login attempts to web applications.

Question 20

A security analyst needs to identify all Windows event codes where the count of events exceeds 100 in the last 24 hours, and then display the results sorted by count in descending order. The base search returns events with the field 'EventCode'. Which SPL search accomplishes this?

Accepted Answer

index=windows EventCode=* | stats count by EventCode | where count > 100 | sort - count. The search must count events per EventCode, filter for counts greater than 100, and sort descending. The stats command aggregates counts, where filters after aggregation, and sort orders the final results. Placing where after stats is correct because count is only available after aggregation.

Answer

index=windows EventCode=* | top limit=100 EventCode | sort - count

Answer

index=windows EventCode=* | stats count by EventCode | sort - count | where count > 100

Answer

index=windows EventCode=* | where count > 100 | stats count by EventCode | sort - count