SPLK-5001 Practice Test 5 — 25 Questions

Question 1

Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?

Accepted Answer

Risk Analysis configuration. Risk Analysis configuration (A) is correct because it is the Splunk ES area where you define and tune risk framework settings such as risk scores, risk objects, and risk index/threshold behavior used by risk-based alerting. The Correlation Search Editor (D) is also correct because RBA relies on correlation searches to generate risk events, and this editor is where you configure the search logic, risk annotations, and risk message/score actions that feed the risk framework. The License Master UI (B) only handles licensing and does not configure RBA behavior. The Knowledge Object Manager (C) is a general object-management interface, not the dedicated RBA configuration area. The Data Model Acceleration UI (E) manages acceleration for data models and is unrelated to defining risk-based alerting configurations.

Answer

License Master UI

Answer

Knowledge Object Manager

Answer

Data Model Acceleration UI

Question 2

A SOC analyst is building a risk-based alerting workflow and wants to ensure that a specific risk rule only contributes to an entity's risk score when the entity is a user account, not a system or IP address. Which configuration in the risk rule's search definition accomplishes this?

Accepted Answer

Set the 'risk_object_type' field to 'user' in the risk event. Risk events carry a risk_object_type field that declares whether the risk applies to a user, system, or other entity. Setting it to 'user' ensures the rule only contributes to user risk scores. Filtering on fields or choosing a data model does not constrain the entity type, and zeroing scores still generates unwanted risk events.

Answer

Set the 'risk_score' field to zero for non-user entities

Answer

Configure the risk rule to use the 'Identity' data model as its primary source

Answer

Add a where clause filtering on the 'user' field being non-null

Question 3

Which THREE of the following represent valid ways to use the 'lookup' command?

Accepted Answer

lookup file.csv field1. Option A is correct because the basic syntax of the lookup command is `lookup

`, so `lookup file.csv field1` is a valid minimal invocation that matches field1 in the CSV against the event field of the same name. Option C is correct because the lookup command supports renaming the input field with `AS` and specifying output fields with `OUTPUT ... AS ...`, so `lookup file.csv field1 AS field_a OUTPUT field2 AS field_b` is valid syntax. Option D is correct because `lookup file.csv field1 OUTPUT field2` is the standard form for matching field1 and returning only field2 from the lookup table. Option B is not valid because `--all` is not a recognized lookup command flag; there is no such option to return all fields. Option E is not valid because `--join` is not a lookup command parameter; lookup does not use a join flag (joins are performed with the `join` command).

Answer

lookup file.csv --all

Answer

lookup file.csv --join

Question 4

Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?

Accepted Answer

Enabling RBA for high-risk users. Option C is correct because Splunk Enterprise Security's Risk-Based Alerting (RBA) aggregates risk scores from risk modifiers and anomaly detections into risk index entries, allowing analysts to prioritize and investigate high-risk users whose cumulative risk exceeds defined thresholds — directly surfacing insider behavior that might otherwise go unnoticed. Option D is correct because Correlation Searches in Splunk ES run on schedules against indexed data and can trigger notable events when patterns such as large outbound data transfers, unusual download volumes, or access to sensitive indexes indicate potential data exfiltration by an insider. The remaining options are not valid Splunk ES mitigations: disabling all network ports (A) would break the Splunk deployment itself and is not a security control, manually logging all user keystrokes (B) is an endpoint/DLP function outside Splunk ES and raises privacy/legal issues, and deleting user accounts immediately (E) is a reactive, destructive action that destroys audit evidence rather than a mitigation method within Splunk ES.

Answer

Disabling all network ports

Answer

Manually logging all user keystrokes

Answer

Deleting user accounts immediately

Question 5

Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?

Accepted Answer

Threat Source management. Option A (Threat Source management) is correct because the Splunk ES Threat Intelligence framework relies on configuring threat sources (such as local CSV lookups, threat intelligence feeds, or TAXII/STIX integrations) to ingest and normalize indicators of compromise into the system. Option E (Threat Intelligence collections) is correct because collections are the core construct that groups related threat intelligence data (e.g., IPs, domains, file hashes) and maps them to intelligence sources for use in correlation searches and adaptive response. Forwarder management (B) belongs to Splunk deployment/server administration for data collection, not the threat intelligence framework. Dashboard customization (C) is a general UI/presentation feature and not a structural component of the TI framework. Incident classification (D) relates to incident review and notable event workflow in ES, but it is not one of the key components that define the Threat Intelligence framework itself.

Answer

Forwarder management

Answer

Dashboard customization

Answer

Incident classification

Question 6

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

Accepted Answer

Executing code to take advantage of a vulnerability.. The Exploitation phase of the Cyber Kill Chain is when the attacker's weaponized payload triggers the vulnerability and executes code on the victim's system. This is the moment the malicious code runs and takes advantage of a software flaw (e.g., a buffer overflow, deserialization bug, or macro execution). It is distinct from Delivery (transmitting the payload) and Installation (establishing persistence).

Answer

Establishing a persistent connection to the attacker.

Answer

Exfiltrating sensitive company data.

Answer

Gathering information about the target.

Question 7

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

Accepted Answer

Email security logs or Web Proxy logs.. MITRE ATT&CK's Initial Access tactic covers techniques like phishing (T1566), exploitation of public-facing applications (T1190), and valid accounts (T1078). Phishing is the most common initial access vector, so email security logs are primary for detecting malicious attachments, links, and sender anomalies. Web proxy logs are also primary because they capture drive-by compromise and access to malicious URLs used in initial access. Together they provide the telemetry needed to investigate Initial Access alerts.

Answer

Local authentication logs.

Answer

Process audit logs.

Answer

Registry modification logs.

Question 8

A user reports that a specific dashboard panel is timing out. After checking the search job, you notice it is scanning too much data. Which configuration should you adjust?

Accepted Answer

Optimize the search query and use data model summaries.. A dashboard panel timing out because it scans too much data is a search efficiency problem, not a resource or configuration limit problem. Optimizing the SPL (narrowing the time range, filtering early, using tstats) and leveraging accelerated data model summaries drastically reduces the data scanned and returns results within the panel's timeout window. This addresses the root cause rather than masking the symptom.

Answer

Increase the 'max_search_results' in limits.conf.

Answer

Increase the memory for the Splunk web server.

Answer

Re-install the Splunk app.

Question 9

Which TWO factors influence an object's final risk score in Splunk ES?

Accepted Answer

Individual risk event scores. In Splunk Enterprise Security, an object's final risk score is derived from the individual risk events associated with that object, so option C is correct because each contributing risk event carries its own risk score that feeds into the object's overall score. Option D is also correct because the aggregation method configured for the risk framework — such as sum, average, or max — determines how those individual risk event scores are combined into the final object risk score. Options A and B are incorrect because the number of users in the organization and the total disk space of the index are unrelated to risk score computation. Option E is incorrect because the host's operating system does not factor into how Splunk ES calculates an object's risk score.

Answer

The number of users in the organization

Answer

The total disk space of the index

Answer

The operating system of the host

Question 10

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

Accepted Answer

Detailed SPL search queries. Option C is correct because a threat hunting playbook must contain detailed SPL (Search Processing Language) queries so analysts can actually execute the hunt against SIEM data in Splunk and pivot on the specific fields, indicators, or behaviors being sought; without concrete queries the hunt is theoretical rather than actionable. Option E is correct because incident response escalation steps define what happens when a hunt uncovers malicious activity — who is notified, within what timeframe, and through which channels — which converts a detection into a coordinated, actionable response rather than an unaddressed finding. Options A, B, and D do not belong: the security department budget is a management concern, not a hunt execution component; a network topology map can provide useful context but is not a required element for making a hunt actionable; and a list of all employees is an HR/PII inventory that does not drive hunt execution or escalation.

Answer

The budget for the security department

Answer

A copy of the company's network topology map

Answer

A list of all employees in the company

Question 11

In the Incident Review dashboard, what does 'Status' represent?

Accepted Answer

The stage of the investigation workflow.. In the Splunk Enterprise Security Incident Review dashboard, the 'Status' field represents the stage of the investigation workflow — values like New, In Progress, Pending, Resolved, and Closed track where an analyst is in the triage process. It is a workflow state, not a severity, risk score, or ownership field. This is distinct from 'Urgency', 'Severity', and 'Owner', which are separate columns.

Answer

The assignment to an analyst.

Answer

The severity of the threat.

Answer

The risk score of the notable.

Question 12

An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?

Accepted Answer

Endpoint. The Endpoint data model is designed to capture process execution, file system activity, and other host-based events, which are exactly the artifacts left by living-off-the-land techniques. Tools like PowerShell, WMI, and certutil run as processes on endpoints, so their invocation is recorded in endpoint telemetry. This data model normalizes fields such as process_name, parent_process, and command_line, enabling effective detection of suspicious use of legitimate binaries.

Answer

Network Traffic

Answer

Authentication

Answer

Change Analysis

Question 13

Which command is used to visualize data in a time-series chart?

Accepted Answer

timechart count by sourcetype. The timechart command is purpose-built for time-series visualization in Splunk. It bins events by _time automatically and produces a table where each row is a time bucket and each column is a series (here, split by sourcetype), which the Splunk UI renders as a line/area chart. Because it aggregates over time by default, it is the canonical command for trend visualization.

Answer

graph count _time

Answer

stats count over time

Answer

chart count by _time

Question 14

When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?

Accepted Answer

It allows the system to aggregate disparate alerts onto a single entity.. In Splunk ES Risk Analysis, a Risk Object is the entity (user, system, IP, or other) to which risk is attributed. Assigning a Risk Object lets the framework aggregate risk scores from many different correlation searches and notable events onto that single entity, so analysts see a consolidated risk posture rather than isolated alerts. This aggregation is the core value of risk-based alerting.

Answer

It automatically blocks the user from the network.

Answer

It increases the search performance.

Answer

It deletes the original notable event.

Question 15

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Accepted Answer

Correlation Search Suppression. Correlation Search Suppression is the mechanism in Enterprise Security for filtering out specific events from a correlation search's results, including low-fidelity risk events. Suppression rules let you define field-based conditions (e.g., specific risk_object or signature) so matching events are excluded before they generate risk or notables, which is exactly what the customer needs.

Answer

Risk Index Retention Policy

Answer

Data Model Acceleration

Answer

Asset and Identity Table

Question 16

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

Accepted Answer

Contextual Asset and Identity information.. Option B is correct because Splunk Enterprise Security relies on asset and identity lookups (via the Asset and Identity framework, populated through CSV lookups or identity management) to enrich events with ownership, priority, and user context, which is essential for risk scoring, correlation searches, and notable event triage. Option C is correct because ES correlation searches and data models depend on the Common Information Model (CIM), so raw data must be normalized into CIM-compliant data models (e.g., Authentication, Network_Traffic, Endpoint) using field aliases, tags, and calculated fields for meaningful detections. Option D is correct because ES can only analyze data that is properly indexed and parsed—correct sourcetypes, timestamps, and field extractions are prerequisites before CIM mapping and correlation can occur. Option A is not required; ES works with a single Splunk deployment and does not need a separate instance per sourcetype, as multiple sourcetypes are indexed together. Option E is not required because Splunk Enterprise Security is a software application that runs on supported hardware or virtualized/cloud infrastructure, not a dedicated appliance.

Answer

A separate Splunk instance for every sourcetype.

Answer

A dedicated hardware appliance.

Question 17

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

Accepted Answer

Set the TZ attribute in props.conf for the specific sourcetype.. The TZ attribute in props.conf tells Splunk how to interpret timestamps in a sourcetype when the source data lacks an explicit time zone or uses a non-default one. Setting TZ = <timezone> for the specific sourcetype ensures _time is calculated correctly at index time, so correlation searches evaluate events against the correct time window. This is the canonical, supported fix for time-zone mismatches in source data.

Answer

Modify the data model acceleration schedule.

Answer

Use an eval statement in the search to subtract hours.

Answer

Change the Splunk server time zone.

Question 18

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

Accepted Answer

Lateral Movement. Port 445 is used by SMB (Server Message Block), which is the primary protocol for Windows file sharing and is commonly abused for lateral movement via tools like PsExec, SMBExec, and WannaCry-style propagation. Splunk ES includes a 'Lateral Movement' correlation search that detects suspicious SMB connections, remote service creation, and other lateral movement techniques. Prioritizing this search directly addresses the observed traffic and the suspected malware infection.

Answer

Brute Force Access

Answer

Malware Detection

Answer

DGA Detection

Question 19

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

Accepted Answer

Threat Intelligence Framework. The Threat Intelligence Framework in Splunk ES ingests threat feeds (including TOR exit node lists) and matches them against events via the Threat Intelligence data model and correlation searches. It is the designated feature for identifying whether an IP, domain, or file hash is known malicious. Other ES features handle suppression, identity, or asset context, not threat matching.

Answer

Notable Event Suppressor

Answer

Identity Table

Answer

Asset Table

Question 20

Which TWO Splunk features are best for automating the execution of recurring threat hunts?

Accepted Answer

Scheduled Searches. Scheduled Searches (B) are correct because they let you run a saved search automatically on a cron-based schedule, which is exactly how recurring threat hunts are executed without manual intervention. Alert Actions (D) are correct because they attach automated responses to triggered alerts, such as running a script, sending an email, or invoking a webhook, enabling the hunt to act on findings automatically. Data Model Acceleration (A) only speeds up searches against data models; it does not schedule or automate hunt execution. User Roles (C) govern access permissions and capabilities, not recurring task automation. Splunk Web Framework (E) is a development toolkit for building custom apps and dashboards, not a scheduling or automation mechanism for recurring hunts.

Answer

Data Model Acceleration

Answer

User Roles

Answer

Splunk Web Framework