SPLK-5001 Practice Test 4 — 25 Questions

Question 1

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Accepted Answer

Select the event in Incident Review and choose 'Add to Case'.. From the Incident Review dashboard, analysts can select a notable event and use the 'Action' menu to assign it to an existing case.

Answer

Edit the correlation search definition.

Answer

Modify the risk index directly.

Answer

Use the Case Management dashboard to search for the event ID.

Question 2

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

To triage and manage notable events.. It serves as the central hub for security analysts to triage, investigate, and manage notable events.

Answer

To manage threat intelligence feeds.

Answer

To configure data model acceleration.

Answer

To view real-time system health.

Question 3

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Accepted Answer

Correlation Search Editor. Risk rules are often defined within the correlation search itself, where the risk score is mapped to the event severity.

Answer

Identity Manager

Answer

Risk Index Configuration

Answer

Risk Notable Settings

Question 4

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Accepted Answer

Correlation Search Suppression. Notable event suppression is the native method in Splunk ES to prevent specific event types from triggering notables based on criteria.

Answer

Risk Index Retention Policy

Answer

Data Model Acceleration

Answer

Asset and Identity Table

Question 5

Which TWO factors are critical for effective Asset and Identity enrichment?

Accepted Answer

The consistency of the source data files.. The quality of the input data (CSV/KV Store) and the accuracy of the matching fields (like IP or user) are critical.

Answer

The physical location of the Splunk indexer.

Answer

The number of colors used in the dashboard.

Answer

The version of the OS running on the search head.

Question 6

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

Accepted Answer

Detailed SPL search queries. Actionable hunts require clear search queries and defined 'next steps' for when a hit is found.

Answer

The budget for the security department

Answer

A copy of the company's network topology map

Answer

A list of all employees in the company

Question 7

Which THREE of the following represent valid ways to use the 'lookup' command?

Accepted Answer

lookup file.csv field1. Standard lookup, lookup with OUTPUT, and lookup with AS aliasing are valid.

Answer

lookup file.csv --all

Answer

lookup file.csv --join

Question 8

What does the 'OR' operator do in a search?

Accepted Answer

Matches either condition.. The 'OR' operator returns results that match either condition.

Answer

Excludes the specified condition.

Answer

Matches both conditions.

Answer

Matches only the first condition.

Question 9

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

Managing notable events. Incident Review is the command center for investigating, assigning, and status-tracking notable events.

Answer

Creating threat intelligence feeds

Answer

Monitoring system performance

Answer

Configuring data ingestion

Question 10

You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?

Accepted Answer

Risk Analysis Adaptive Response Action. The Risk Analysis adaptive response action is the core mechanism in Splunk ES used to generate risk events from notable events or correlation searches.

Answer

Asset and Identity Framework

Answer

Correlation Search Editor

Answer

Notable Event Suppression

Question 11

Which search command is used to join threat intelligence data with your local search results?

Accepted Answer

lookup. The 'lookup' command is the standard way to join event data with external or KV store-based threat intelligence.

Answer

join

Answer

map

Answer

append

Question 12

Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?

Accepted Answer

Threat Intelligence Manager.. The Threat Intelligence Manager is the interface for managing and monitoring external threat feeds.

Answer

Security Posture.

Answer

Asset and Identity.

Answer

Incident Review.

Question 13

Which TWO factors directly impact the urgency of a notable event in Splunk ES?

Accepted Answer

The risk score of the event.. Urgency is calculated by combining the event's inherent risk score and the criticality of the system or user (asset) involved.

Answer

The color scheme of the dashboard.

Answer

The total volume of indexed events.

Answer

The number of active users in the system.

Question 14

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Accepted Answer

Splunk Case Management. In Splunk ES, 'Cases' are the primary mechanism for grouping and managing related notable events during an investigation.

Answer

Notable Event Aggregation

Answer

Notable Event Suppression

Answer

Incident Review Filters

Question 15

Which THREE tasks are performed within the 'CIM Setup' interface?

Accepted Answer

Mapping sourcetypes to data models.. CIM Setup allows administrators to map sourcetypes to data models, enable acceleration, and verify CIM compliance.

Answer

Configuring index retention policies.

Answer

Defining user roles and permissions.

Question 16

Which TWO types of events are typically categorized as 'Notable Events'?

Accepted Answer

Manually created incidents in Incident Review.. Notable events are usually generated by high-fidelity correlation searches or by manual user creation in the Incident Review dashboard.

Answer

Events produced by the license master.

Answer

Every log event received by the indexer.

Answer

Browser history of a user.

Question 17

Which THREE of the following are necessary prerequisites for ensuring a new data source is correctly utilized by the ES 'Access' data model?

Accepted Answer

The data must be tagged with the appropriate CIM tags.. Normalization via CIM tags, correct sourcetype identification, and ensuring the data model is accelerated are standard prerequisites for ES data models.

Answer

The data must be sent to the 'main' index.

Answer

The data must be converted to JSON format.

Question 18

A user reports that a specific dashboard panel is timing out. After checking the search job, you notice it is scanning too much data. Which configuration should you adjust?

Accepted Answer

Optimize the search query and use data model summaries.. Adjusting the time range picker or optimizing the search by using specific indexes or summaries will reduce scan volume.

Answer

Increase the 'max_search_results' in limits.conf.

Answer

Increase the memory for the Splunk web server.

Answer

Re-install the Splunk app.

Question 19

You are configuring a 'Notable Event' to use a specific 'Drilldown' link. What syntax is used to pass fields from the event into the URL?

Accepted Answer

$field_name$. Using the dollar sign syntax ($field_name$) allows for dynamic substitution of event fields into the drilldown URL.

Answer

{field_name}

Answer

%field_name%

Answer

[field_name]

Question 20

In the Incident Review dashboard, what does 'Status' represent?

Accepted Answer

The stage of the investigation workflow.. Status tracks the progress of an investigation, such as 'New', 'In Progress', or 'Closed'.

Answer

The assignment to an analyst.

Answer

The severity of the threat.

Answer

The risk score of the notable.