SPLK-5001 Practice Test 4 — 25 Questions

Question 1

When using 'stats', how can you include the values of a field as columns in your output?

Accepted Answer

stats count by host, sourcetype | xyseries host, sourcetype, count. The xyseries command converts the results of a stats aggregation into a matrix (pivot) format, using one field for rows, another for column headers, and a numeric field for cell values. In this case, 'stats count by host, sourcetype' produces rows of (host, sourcetype, count), and 'xyseries host, sourcetype, count' pivots sourcetype values into distinct columns with counts as cell values. This is the canonical SPL way to turn grouped stats output into a wide table with field values as column headers.

Answer

stats count by host, sourcetype

Answer

stats count by host | transpose

Answer

stats pivot host sourcetype

Question 2

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

Accepted Answer

Enable acceleration and define a summary range.. To use a data model for notable event generation in ES, you must enable acceleration and define a summary range, because ES correlation searches rely on accelerated data models for performance. Acceleration creates summary data that the data model can query quickly, and the summary range determines how far back the summaries are retained.

Answer

Configure the data model to use only indexed fields.

Answer

Set the data model to root-level permissions only.

Answer

Manually create tags for every field in the data model.

Question 3

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

Accepted Answer

Event ID 1. Sysmon Event ID 1 is the 'Process Create' event, which logs the full command line, image path, parent process, user, and hashes for every process launched. For detecting living-off-the-land techniques (e.g., powershell.exe, wmic.exe, certutil.exe with suspicious arguments), Event ID 1 is the definitive source for command-line arguments.

Answer

Event ID 7

Answer

Event ID 2

Answer

Event ID 5

Question 4

When dealing with multi-value fields, which command allows you to break them into individual events?

Accepted Answer

mvexpand field_name. The mvexpand command takes a multi-value field and expands each value into its own separate event, duplicating the other fields for each value. This is the standard SPL command for breaking multi-value fields into individual events, and it is commonly used before further aggregation or correlation.

Answer

expand field_name

Answer

mv_to_events field_name

Answer

split field_name

Question 5

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

Accepted Answer

Hunt Procedure and Query Logic. The Hunt Procedure and Query Logic section documents the exact steps, SPL queries, data sources, and expected outputs of the hunt. This is what makes the playbook repeatable by another analyst and auditable later, because it captures the reproducible method rather than just the outcome. Without it, the playbook is not a procedure.

Answer

Threat Intelligence Source List

Answer

Executive Summary

Answer

Hardware Requirements

Question 6

A security analyst is documenting the lifecycle of an investigation in Splunk Enterprise Security. Which statement accurately describes how cases and notables relate within that lifecycle?

Accepted Answer

A notable can be added to a case, and a single case can contain multiple notables and associated events.. Cases serve as containers for investigations and can include multiple notables along with related events and artifacts. Analysts add notables to a case to group related findings, enabling coordinated analysis, evidence collection, and documentation. This relationship supports the workflow of triaging individual notables and then consolidating related ones into a single investigative record.

Answer

A case is automatically created for every notable event generated by a correlation search.

Answer

Closing a case automatically closes all notables that were added to it, preventing further review.

Answer

Notables and cases are stored in the same index and are distinguished only by their source type.

Question 7

During a threat hunt for data exfiltration, you want to identify endpoints that transferred an unusually large volume of data to external IP addresses compared to their normal baseline. Which Splunk approach best accomplishes this using the Network_Traffic data model?

Accepted Answer

Use tstats to compute per-host outbound bytes from Network_Traffic.All_Traffic, then compare each host's recent total to its historical average and flag significant deviations.. Exfiltration detection hinges on identifying hosts whose outbound transfer volume deviates from their own historical norm. Aggregating bytes per host through the accelerated Network_Traffic data model and comparing recent totals to a baseline surfaces those deviations efficiently, while static thresholds or unrelated DNS signals fail to capture the volume anomaly.

Answer

Search for DNS queries to newly registered domains and assume any resolution indicates exfiltration.

Answer

Run a raw search over index=firewall and manually review the top talkers by bytes for the past hour.

Answer

Create an alert that fires whenever any host sends more than 1 GB in an hour, regardless of its typical usage.

Question 8

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

Accepted Answer

In the 'Comments' section of the Case.. In Splunk Enterprise Security, the Case Management feature provides a 'Comments' section where analysts can document investigation findings, and these comments are stored with the case and visible to all team members who have access to the case. This ensures collaboration and continuity across shifts.

Answer

In the splunkd.log file.

Answer

By modifying the correlation search.

Answer

In the Asset and Identity manager.

Question 9

A SOC manager wants to ensure that when a notable event is reviewed and closed, the analyst's disposition and any supporting evidence are preserved for audit purposes. Which Splunk ES feature should the manager use to capture this information?

Accepted Answer

Notable event comments and status updates in the Incident Review dashboard.. Incident Review is the central place where analysts document their investigation of notable events. Comments, status changes, and ownership updates are stored with the notable, creating an audit trail of the disposition and evidence. This satisfies the requirement to preserve review outcomes for audit purposes without additional tooling.

Answer

The `_internal` index, which logs all notable event status changes and comments.

Answer

The Search & Reporting app's saved search history for the correlation search that generated the notable.

Answer

The Audit trail in Splunk ES settings, which records all configuration changes to correlation searches.

Question 10

You are building a correlation search that must trigger a notable event when a user's risk score exceeds 100 within a 24-hour period. The risk score is calculated from multiple risk events across different indexes. Which Splunk ES component should you use to aggregate the risk events and evaluate the threshold?

Accepted Answer

Risk Analysis framework with a correlation search using the 'risk' index. The Risk Analysis framework is designed to collect risk events into the 'risk' index, where they can be aggregated and analyzed. A correlation search can then query the 'risk' index, sum risk scores by user over a 24-hour window, and trigger a notable when the total exceeds 100. This approach leverages the built-in risk framework and is the correct way to implement risk-based alerting in Splunk ES.

Answer

Threat Intelligence framework with a lookup of known malicious users

Answer

Incident Review dashboard with a custom filter for risk score

Answer

Data Model acceleration on the Risk data model

Question 11

Which search command is used to join threat intelligence data with your local search results?

Accepted Answer

lookup. The lookup command is the standard SPL command for enriching local search results with external data, including threat intelligence lookups. It matches fields in the event stream against a lookup table (CSV, KV Store, or external) and returns additional fields, making it the correct tool for joining threat intel with local results.

Answer

join

Answer

map

Answer

append

Question 12

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

Accepted Answer

Risk Analysis configuration in ES Settings.. The risk score lifespan (decay) is configured in the Risk Analysis configuration within ES Settings. This setting defines how long risk events contribute to an object's risk score before decaying, and it controls the decay rate applied to risk scores over time. If decay is not occurring, this configuration is where to investigate.

Answer

Data model acceleration TTL.

Answer

Search Scheduler settings.

Answer

Notable event retention settings.

Question 13

You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?

Accepted Answer

outputlookup ioc_list.csv. The outputlookup command is used to write search results to a lookup table file, such as a CSV. It takes the results of the current search and outputs them to the specified lookup file, dynamically updating it with new IOCs. This is the standard method for updating lookup tables from search results.

Answer

saveas lookup ioc_list.csv

Answer

write ioc_list.csv

Answer

inputlookup ioc_list.csv --append

Question 14

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

Accepted Answer

Endpoint. The Endpoint data model is designed to capture process execution, command-line arguments, and script block logging on hosts, which are essential for detecting obfuscated PowerShell. It includes fields like process, process_name, and process_exec that store the full command line, allowing you to search for encoded commands (e.g., -EncodedCommand). Since PowerShell obfuscation occurs at the endpoint level, this data model provides the necessary context to identify and investigate such activity.

Answer

Network Sessions

Answer

Web

Answer

Authentication

Question 15

You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?

Accepted Answer

Subsearches are limited by the 'maxout' configuration and execution time.. Subsearches in Splunk are constrained by the 'maxout' setting (default 50,000 results) which caps how many results the subsearch can return to the outer search, and by subsearch execution time limits (default 60 seconds via 'maxtime'). Exceeding either causes the subsearch to be truncated or aborted, silently dropping results and producing incomplete correlation.

Answer

Subsearches only return the first 10 results.

Answer

Subsearches cannot use the 'stats' command.

Answer

Subsearches cannot reference fields from the outer search.

Answer

Subsearches always run after the outer search completes.

Question 16

When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?

Accepted Answer

To attribute risk to a specific object, such as a user or system.. The Risk Analysis adaptive response action in a correlation search is used to attribute risk to a specific object (such as a user, system, or IP) by adding a risk score and risk message to that object. This feeds into the risk-based alerting framework, allowing ES to accumulate risk and generate notables when thresholds are exceeded.

Answer

To purge malicious events from the index.

Answer

To notify the SOC manager via email.

Answer

To automatically block the offending IP address on the firewall.

Question 17

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

Accepted Answer

Configure > Threat Intelligence > Threat Sources. In Splunk Enterprise Security, threat intelligence sources are configured and monitored under Configure > Threat Intelligence > Threat Sources. This page lists all configured intelligence sources, their status (enabled/disabled), last update time, and any errors, allowing you to confirm active ingestion. It is the authoritative location for verifying threat feed health.

Answer

Configure > Data Inputs

Answer

Dashboard > Threat Intelligence

Answer

Configure > Content Management

Question 18

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

Accepted Answer

Change Analysis. The Change Analysis CIM data model is designed to capture changes to system configuration, including audit policy modifications. When auditpol.exe is used to alter audit policies, the resulting Windows Security event (typically Event ID 4719, 'System audit policy was changed') maps to Change Analysis via fields like object, change_type, and user. Network Traffic, Endpoint, and Authentication models do not represent configuration-change events.

Answer

Network Traffic

Answer

Endpoint

Answer

Authentication

Question 19

A security team wants to align their Splunk Enterprise Security (ES) deployment with the NIST Cybersecurity Framework (CSF) 2.0 to improve governance and risk management. They are specifically focused on the 'Identify' function. Which of the following activities best exemplifies the use of Splunk ES to support the 'Identify' function?

Accepted Answer

Using the Asset and Identity framework to maintain an up-to-date inventory of critical systems and their owners.. The Identify function in NIST CSF 2.0 focuses on understanding the cybersecurity risks to systems, people, assets, data, and capabilities. Splunk ES's Asset and Identity framework provides a centralized way to manage and correlate asset information, which is essential for identifying what needs protection and assessing risk. This directly supports the Identify function by maintaining an accurate inventory and context for critical assets, enabling effective governance and risk management.

Answer

Using the Risk Analysis dashboard to prioritize vulnerabilities based on asset criticality and threat intelligence.

Answer

Configuring correlation searches to detect unauthorized access attempts and generate notable events.

Answer

Implementing automated response actions to isolate infected endpoints upon detection of malware.

Question 20

During an investigation, an analyst observes multiple `Endpoint` events where `lsass.exe` is accessed with `PROCESS_VM_READ` by a non-standard binary named `diagtrack.exe` running from `C:\Users\Public\`. Which Splunk ES data model and field combination best supports detecting this credential-dumping behavior?

Accepted Answer

Endpoint data model, correlating `process_name` and `process_id` with `access` events from the `Processes` node. Detecting credential dumping requires visibility into process access events, which the Endpoint data model provides through its Processes node. By correlating the source binary with the target lsass.exe and the granted access mask, Splunk ES can identify suspicious memory reads that are characteristic of tools like Mimikatz or custom dumpers, even when the binary name is masqueraded.

Answer

Network_Traffic data model, filtering on `dest_port` and `bytes_out` to detect exfiltration

Answer

Authentication data model, using `user` and `src` fields to identify failed logon attempts

Answer

Change_Analysis data model, monitoring registry key modifications under `HKLM\SAM`