SPLK-5001 Practice Test 2 — 30 Questions

Question 1

Which THREE elements are essential for a well-defined risk-based alert?

Accepted Answer

A threshold for notable generation. RBA requires identifying the risk object, assigning a score, and using a correlation search to monitor that risk.

Answer

Manual approval for every alert

Answer

Hardware-level encryption

Question 2

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

Accepted Answer

Change the notable event status. Analysts can run adaptive response actions and manage the notable event status directly from this dashboard.

Answer

Modify the correlation search code

Answer

Rebuild the threat intelligence index

Answer

Delete the underlying index

Question 3

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

Accepted Answer

Contextual Asset and Identity information.. Success requires indexed data, normalized data (CIM), and contextual information (Assets/Identities).

Answer

A separate Splunk instance for every sourcetype.

Answer

A dedicated hardware appliance.

Question 4

What is the purpose of the 'Investigation Workbench' in Splunk ES?

Accepted Answer

To provide a unified view of incident artifacts.. The Investigation Workbench provides a centralized view of all entities, events, and context related to a specific incident.

Answer

To run administrative index maintenance.

Answer

To manage user identities.

Answer

To configure correlation searches.

Question 5

You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?

Accepted Answer

splunkd.log. The splunkd.log file contains internal diagnostic information about adaptive response actions executed by the correlation search scheduler.

Answer

correlation_search.log

Answer

notable_events.log

Answer

risk_index.log

Question 6

A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?

Accepted Answer

Data Model Acceleration. Data model acceleration allows Splunk to pre-calculate and store data models, making correlation searches run significantly faster than raw searches across indices.

Answer

Summary Indexing

Answer

Correlation Search Tuning

Answer

Lookup file generation

Question 7

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

Accepted Answer

Risk Data Model. While it can run on raw events, the Risk Analysis action is often used in correlation searches that monitor data models like 'Network Traffic' or 'Authentication'.

Answer

Vulnerability Data Model

Answer

Threat Intelligence Data Model

Answer

Endpoint Data Model

Question 8

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

Accepted Answer

Risk Analysis Dashboard. The Risk Analysis dashboard allows analysts to drill down into the specific risk events contributing to a user's total risk score.

Answer

Threat Activity Dashboard

Answer

Access Anomalies Dashboard

Answer

Incident Review

Question 9

You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?

Accepted Answer

Create a Notable Event Suppression entry.. Notable Event Suppression allows you to define specific filter criteria based on fields like host, user, or signature to ignore known false positives.

Answer

Lower the urgency of the notable event.

Answer

Modify the correlation search cron schedule.

Answer

Delete the scan data from the index.

Question 10

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Accepted Answer

Host/Asset context. The framework is primarily used to add context to users and hosts (assets).

Answer

Encrypted packet captures

Answer

Raw web server application logs

Answer

System performance statistics

Question 11

What is the purpose of the 'head' command?

Accepted Answer

Return the first N results.. The 'head' command returns the first N results from a search.

Answer

Return the last N results.

Answer

Sort the results.

Answer

Count the results.

Question 12

You are investigating a potential data exfiltration event. You have a lookup file called 'authorized_servers.csv' containing a field 'ip_address'. You want to find all connections to IPs not in this list. Which command fulfills this?

Accepted Answer

index=network | lookup authorized_servers.csv ip_address AS dest_ip OUTPUT ip_address as is_authorized | where is_authorized="". The 'inputlookup' combined with 'NOT [search]' or the 'lookup' command with a filter is used for exclusion.

Answer

index=network | inputlookup authorized_servers.csv | where dest_ip!=ip_address

Answer

index=network | lookup authorized_servers.csv dest_ip | where isnull(dest_ip)

Answer

index=network | filter dest_ip NOT IN authorized_servers.csv

Question 13

Which TWO of the following are common types of social engineering?

Accepted Answer

Pretexting. Phishing and pretexting are classic examples of social engineering techniques.

Answer

Buffer Overflow

Answer

SQL Injection

Answer

Port Scanning

Question 14

You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?

Accepted Answer

$SPLUNK_HOME/etc/apps/<app_name>/bin. The script must be placed in the 'bin' directory of the specific Add-on or app directory to be accessible by the Splunk search process.

Answer

The root of the Splunk installation directory.

Answer

/etc/system/bin

Answer

/var/lib/splunk/scripts

Question 15

When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?

Accepted Answer

Use the CIM Validator app to check compliance against the data model.. Using the CIM Validator app or running a search with the 'datamodel' command allows you to verify if the fields match the CIM requirements.

Answer

Disable and re-enable the Enterprise Security app.

Answer

Change the sourcetype to 'cisco_asa' manually.

Answer

Re-index all firewall logs from the past 30 days.

Question 16

Which THREE components are required for an Adaptive Response action to function?

Accepted Answer

The Adaptive Response action must be enabled.. Adaptive response requires an enabled action, a configured Add-on (for the target system), and proper credentials.

Answer

A permanent connection to the Internet.

Answer

A user with 'Admin' role on all indexers.

Question 17

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

Accepted Answer

Using the 'lookup' command against a KV Store collection.. Threat intel can be added via the 'Threat Intelligence' framework (using KV Store lookups) or by using standard 'lookup' commands against threat feeds.

Answer

By changing the user's password.

Answer

By editing the indexer's configuration files.

Answer

By deleting the old notable events.

Question 18

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

Accepted Answer

eval decoded=base64_decode(field). The 'base64_decode' function in SPL is designed to handle this specific transformation.

Answer

rex field=field "(?<decoded>.*)"

Answer

transform base64 field

Answer

eval decoded=decode(field, "base64")

Question 19

A security analyst needs to reduce the noise generated by a specific correlation search that triggers too frequently for authorized internal vulnerability scanners. What is the most efficient way to handle this in Splunk ES?

Accepted Answer

Use the Notable Event Suppression feature within the Incident Review dashboard.. Notable event suppression allows analysts to define criteria where events matching specific patterns (like a known scanner IP) are ignored, preventing them from appearing as notable events.

Answer

Disable the correlation search and create a new one with an exclusion filter.

Answer

Modify the search logic to use an 'eval' statement to filter out the scanner IP address.

Answer

Change the risk score of the notable event to zero in the correlation search configuration.

Question 20

You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?

Accepted Answer

search dest_ip=x.x.x.x | streamstats current=f window=2 global=f last(_time) as prev_time | eval diff=_time - prev_time. The streamstats command allows for calculating intervals between events, which is critical for identifying beaconing patterns in network traffic.

Answer

search dest_ip=x.x.x.x | rare dest_ip

Answer

search dest_ip=x.x.x.x | timechart span=1h count

Answer

search dest_ip=x.x.x.x | stats count by _time