SPLK-5001 Practice Test 3 — 10 Questions

Question 1

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

Accepted Answer

The 'Incident Review' dashboard for documenting resolution steps.. The 'Incident Review' dashboard in Splunk Enterprise Security is the built-in workspace where analysts document investigation findings, resolution steps, and post-incident notes tied to notable events. This directly supports the NIST CSF 'Recover' function, which emphasizes restoring capabilities and documenting lessons learned after an incident. Because Incident Review captures the full lifecycle of a notable event — from triage through closure — it is the natural artifact for demonstrating a documented incident response process.

Answer

The 'Data Model Acceleration' settings.

Answer

The 'Threat Intelligence' upload manager.

Answer

The 'Workflow Actions' settings for firewall rule creation.

Question 2

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

Accepted Answer

index=windows EventCode=4688 | stats count by ParentProcessName, ProcessName. EventCode 4688 is Windows Security logging for process creation, and it includes both the new process name and the parent process name. By using stats count by ParentProcessName, ProcessName, an analyst can spot wmiprvse.exe spawning unusual shells like cmd.exe or powershell.exe, which is a hallmark of WMI lateral movement. The other event codes cover service installation, logon activity, or service creation, not process lineage.

Answer

index=windows EventCode=4697 | table User, ServiceName

Answer

index=windows EventCode=4624 | table Logon_Type, User

Answer

index=windows EventCode=7045 | stats count by ServiceName

Question 3

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

Accepted Answer

It focuses on aggregated behavior to reduce noise.. Risk-Based Alerting aggregates risk contributions from multiple detections into a single risk score per entity, then alerts only when the score crosses a threshold. This focuses analysts on correlated, aggregated behavior rather than individual low-fidelity events, dramatically reducing alert noise while surfacing meaningful attack patterns.

Answer

It alerts on every single event.

Answer

It eliminates the need for correlation searches.

Answer

It ignores all low-severity events.

Question 4

A junior analyst is asked to find all risk events associated with a specific user account to assess potential insider threat activity. Which search command should the analyst use to retrieve these risk events from the risk index?

Accepted Answer

index=risk user=jsmith. Risk events are stored in the risk index, so searching index=risk with a user filter retrieves all relevant risk events. The notable index contains notables, not raw risk events. The risk command generates risk, not retrieves it. Thus, the direct index search is correct.

Answer

| risk user=jsmith

Answer

index=main user=jsmith

Answer

index=notable user=jsmith

Question 5

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration incident. The analyst wants to determine the stage of the attack according to the Cyber Kill Chain. The analyst observes that a large volume of data is being transferred from an internal database server to an external IP address. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Actions on Objectives. The Cyber Kill Chain's Actions on Objectives phase encompasses the attacker's ultimate goal, which often includes data exfiltration. The observation of a large data transfer from an internal database to an external IP is a clear indicator of exfiltration, placing it in the Actions on Objectives phase. This phase occurs after the attacker has established a foothold and command-and-control, and is now executing their mission.

Answer

Command and Control

Answer

Installation

Answer

Exploitation

Question 6

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Accepted Answer

The 'notable' index logs.. The 'notable' index logs (A) are useful because correlation searches generate notable events that are written to the notable index, so inspecting it reveals whether the search fired and what it produced. scheduler.log (C) is essential because it records the scheduling of correlation searches, including skipped, deferred, or failed runs and any errors thrown during execution. The Search Job Inspector (E) is useful because it exposes the exact SPL executed, search duration, and detailed execution costs/errors, helping pinpoint why a correlation search misbehaves. The Splunk License usage report (B) only shows indexing volume against license limits and does not diagnose search logic or scheduling failures, and the user's web browser cache (D) is a client-side artifact unrelated to server-side correlation search execution.

Answer

The Splunk License usage report.

Answer

The user's web browser cache.

Question 7

A security analyst is reviewing the Incident Review dashboard in Splunk ES and wants to add a new field to the table that displays notable events. The field, 'src_ip', is already present in the notable event's raw data but not displayed. What should the analyst do to make this field visible in the Incident Review table?

Accepted Answer

Configure the 'Incident Review - Table Attributes' settings in Splunk ES to include 'src_ip'.. The Incident Review table attributes are configurable through Splunk ES settings. Adding 'src_ip' to the list of attributes will make it appear as a column in the Incident Review dashboard, allowing analysts to see the source IP directly without altering the correlation search or creating custom dashboards.

Answer

Edit the correlation search to include 'src_ip' in the search results and re-run it.

Answer

Modify the Incident Review dashboard's table settings to add 'src_ip' as a column.

Answer

Create a new dashboard that queries notable events and includes 'src_ip'.

Question 8

An analyst needs to review firewall traffic but only for events where the action field is explicitly 'blocked' and the bytes_out field is greater than 5000. Some events are missing the action field entirely. Which SPL search returns only events that satisfy both conditions?

Accepted Answer

index=firewall action=blocked bytes_out>5000. In SPL, multiple search terms typed into the base search are implicitly combined with AND logic. Writing action=blocked bytes_out>5000 therefore requires both field conditions to be true for an event to be returned. Because events missing the action field cannot satisfy action=blocked, they are silently dropped, which matches the requirement to review only complete, explicitly blocked high-volume traffic.

Answer

index=firewall action=blocked OR bytes_out>5000

Answer

index=firewall action=blocked NOT bytes_out>5000

Answer

index=firewall action=blocked bytes_out<5000

Question 9

A security analyst notices that a correlation search configured to detect multiple failed logins across the organization is not triggering notable events, even though the raw events are searchable. The correlation search uses the Authentication data model. Upon investigation, the analyst finds that the Authentication data model is not accelerated. What is the most likely reason the correlation search is failing to generate notables?

Accepted Answer

The correlation search requires the Authentication data model to be accelerated to efficiently retrieve and correlate events, and without acceleration, it may time out or return no results.. The Authentication data model must be accelerated for correlation searches to efficiently query it. Without acceleration, the search may time out or return incomplete results, preventing notable event creation. Acceleration builds summaries that speed up searches, which is essential for timely detection in Splunk ES.

Answer

The correlation search is configured to run in real-time mode, which is disabled for accelerated data models.

Answer

The correlation search is missing the 'action.notable' alert action, so it cannot create notable events.

Answer

The correlation search's cron schedule is set to run only during off-peak hours, so it hasn't executed yet.

Question 10

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Accepted Answer

Risk Message. In the Risk Analysis adaptive response action, the Risk Object (D) specifies which entity type the risk is applied to, such as a user, host, or IP address, making it a required configurable field. The Risk Score (C) sets the numeric risk value (typically 0–100) that the action assigns to that object, which is the core purpose of the action. The Risk Message (B) provides a descriptive text string explaining why the risk was assigned, and it is also configurable within the action. CPU core count (A) and network interface speed (E) are hardware/resource parameters unrelated to risk analysis and cannot be set in this adaptive response action.

Answer

CPU core count

Answer

Network interface speed