SPLK-5001 Practice Test 4 — 10 Questions

Question 1

Which command is used to rename a field in the results table for better readability?

Accepted Answer

rename src_ip as "Source Address". The rename command is specifically designed to rename fields in search results, and the syntax 'rename src_ip as "Source Address"' correctly renames the field src_ip to "Source Address" for display purposes. This is the standard SPL way to improve readability of field names in tables.

Answer

table src_ip as "Source Address"

Answer

fields src_ip:"Source Address"

Answer

eval "Source Address" = src_ip

Question 2

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

Accepted Answer

file_hash. The file_hash field in a Splunk ES notable event contains the hash (MD5/SHA) of the file involved in the detection, which is the primary pivot key for the File domain investigation dashboard. That dashboard is designed to look up file reputation, sandbox results, and endpoint activity by hash, making file_hash the most effective field for pivoting there.

Answer

src_user

Answer

signature

Answer

dest_port

Question 3

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration event. They need to determine which MITRE ATT&CK tactic describes the adversary's objective of stealing data from the compromised network. Which tactic should they reference?

Accepted Answer

Exfiltration. Exfiltration is the correct ATT&CK tactic for data theft. It encompasses techniques like exfiltration over C2 channel, exfiltration over alternative protocol, and exfiltration over physical medium. In Splunk ES, analysts should look for correlation searches that detect anomalous outbound data volumes or connections to known malicious IPs, and ensure these are tagged with the Exfiltration tactic for accurate reporting.

Answer

Collection

Answer

Impact

Answer

Command and Control

Question 4

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

Accepted Answer

The value added to the object's risk score.. In the Risk Analysis adaptive response, the 'risk_score' parameter specifies the numeric value that will be added to the risk score of the object (user, system, or other entity) associated with the notable event. It is the incremental contribution of that specific risk event, not the object's total score or a threshold.

Answer

The severity level of the notable event.

Answer

The threshold for triggering a notable.

Answer

The total risk score for the object.

Question 5

A SOC manager wants to review the overall risk posture of the organization by examining the highest-risk users and systems over the past week. Which Splunk Enterprise Security dashboard provides this aggregated view of risk objects and their scores?

Accepted Answer

Risk Analysis. The Risk Analysis dashboard is designed to display risk scores aggregated by risk object, such as users and systems. It allows security managers to quickly identify which entities have the highest accumulated risk, providing a clear view of organizational risk posture over a selected time range.

Answer

Incident Review

Answer

Security Posture

Answer

Threat Activity

Question 6

A SOC manager is aligning Splunk Enterprise Security with the NIST Cybersecurity Framework. They need to ensure that the 'Respond' function is properly supported. Which Splunk ES feature is specifically designed to facilitate the 'Respond' function by automating actions such as blocking IPs or disabling users?

Accepted Answer

Adaptive Response. Adaptive Response is the Splunk ES feature that directly supports the NIST CSF Respond function by enabling automated and manual actions on notable events. It allows analysts to execute scripts, block IPs, disable users, and more, thereby containing threats rapidly. This aligns with the Respond function's objectives of containment, mitigation, and improvement.

Answer

Incident Review

Answer

Threat Intelligence Framework

Answer

Risk Analysis

Question 7

An analyst is reviewing a notable event for a potential malware infection on a Windows endpoint. The event includes a file hash. To determine if the file is known malicious, the analyst wants to check its reputation using Splunk ES's threat intelligence framework. Which action should the analyst take?

Accepted Answer

Search the file hash in the Threat Intelligence data model to see if it matches any threat intel sources.. Splunk ES integrates threat intelligence feeds into the Threat Intelligence data model. By searching for the file hash there, the analyst can quickly see if it matches any known malicious indicators. The other options focus on endpoint activity or manual lists, which do not provide the same breadth of reputation data from multiple sources.

Answer

Run a search against the Endpoint data model to find all processes that executed the file hash.

Answer

Check the 'File Hash' field in the Malware data model to see if it is associated with any known malware families.

Answer

Use the 'threatlist' lookup to manually add the hash and then check if it appears in any notable events.

Question 8

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Accepted Answer

Scanning external IP ranges for open ports.. Reconnaissance in the Cyber Kill Chain involves information gathering and scanning to identify potential targets. Scanning external IP ranges for open ports is a classic reconnaissance activity, as it helps attackers map the attack surface. The other options represent later stages: spear-phishing is delivery, encryption for ransom is actions on objectives, and installing a backdoor is installation.

Answer

Sending a spear-phishing email.

Answer

Encrypting user files for ransom.

Answer

Installing a backdoor on a web server.

Question 9

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Accepted Answer

Change Analysis. The Change Analysis data model in Splunk ES tracks changes to system configurations, including audit log clears and service changes. Clearing the Windows Security Event log generates Event ID 1102 (or 104 for older systems), which the Change Analysis data model captures as a change event, making it the correct detection source.

Answer

Endpoint

Answer

Network Traffic

Answer

Authentication

Question 10

An analyst is investigating a suspected credential dumping attack on a Windows host. They want to identify evidence of this activity in Splunk ES. Which TWO of the following are valid indicators of credential dumping that can be found in Splunk ES data? (Choose two.)

Accepted Answer

Presence of a file named “lsass.dmp” in a temp directory. Credential dumping involves extracting credentials from memory or files. Access to lsass.exe with suspicious access rights indicates an attempt to read its memory, where credentials are stored. The creation of a file named lsass.dmp is a direct artifact of dumping the lsass process memory. Both indicators are observable in Splunk ES via endpoint data models and are strong evidence of credential dumping activity.

Answer

Anomalous number of failed logon attempts

Answer

Creation of a new service with a random name

Answer

Unexpected modification of the hosts file