SPLK-5001 Practice Test 5 — 10 Questions

Question 1

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Accepted Answer

Email gateway logs and web proxy logs.. The Delivery phase of the Cyber Kill Chain covers how the attacker transmits the weaponized payload to the victim — typically via email attachments, malicious links, or drive-by downloads. Email gateway logs capture delivery attempts (attachments, sender reputation, URL clicks), and web proxy logs capture drive-by download and malicious URL access. These two sources are the primary telemetry for correlating alerts to the Delivery stage.

Answer

Domain Controller authentication logs.

Answer

Internal host process creation logs.

Answer

Endpoint file integrity monitoring.

Question 2

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

Accepted Answer

The 'Authentication' Data Model.. Lateral movement in MITRE ATT&CK involves an adversary moving from one host to another, which is detected in Splunk ES primarily through authentication activity — logons, remote service creation, and credential use across systems. The Authentication data model normalizes logon/logoff, privilege escalation, and related events, and ES correlation searches for lateral movement (e.g., 'Detect Lateral Movement' or 'Excessive Authentication Failures') rely on it. Without the Authentication data model populated and accelerated, those detections cannot fire.

Answer

The 'Network Resolution' Data Model.

Answer

The 'Vulnerability' Data Model.

Answer

The 'Malware' Data Model.

Question 3

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

Accepted Answer

Asset Investigator. The Asset Investigator dashboard in Splunk ES provides a consolidated view of assets, including their criticality, identity, and associated risk. It is the primary place to see assets categorized by business criticality and to pivot into asset-specific investigation. This matches the requirement of summarizing all assets by criticality.

Answer

Threat Activity

Answer

User Activity

Answer

Access Anomalies

Question 4

During an investigation, an analyst needs to correlate a series of authentication failures with subsequent successful logins from the same source across multiple indexers. Which Splunk Enterprise Security capability is most appropriate for this task?

Accepted Answer

The Authentication data model, which normalizes authentication events and supports pivoting across users, sources, and outcomes.. The Authentication data model normalizes authentication events from diverse sources into a consistent schema with fields for user, source, action, and outcome. This allows analysts to correlate failed and successful authentications from the same source across multiple indexers. It is purpose-built for authentication investigations, unlike network, risk, or web data models that serve different analytic needs.

Answer

The Network Traffic data model, which captures sessions and can reveal authentication attempts embedded in network flows.

Answer

The Risk data model, which aggregates risk events and can show whether authentication failures contributed to an entity's score.

Answer

The Web data model, which captures HTTP activity and can include login attempts to web applications.

Question 5

A security analyst needs to identify all Windows event codes where the count of events exceeds 100 in the last 24 hours, and then display the results sorted by count in descending order. The base search returns events with the field 'EventCode'. Which SPL search accomplishes this?

Accepted Answer

index=windows EventCode=* | stats count by EventCode | where count > 100 | sort - count. The search must count events per EventCode, filter for counts greater than 100, and sort descending. The stats command aggregates counts, where filters after aggregation, and sort orders the final results. Placing where after stats is correct because count is only available after aggregation.

Answer

index=windows EventCode=* | top limit=100 EventCode | sort - count

Answer

index=windows EventCode=* | stats count by EventCode | sort - count | where count > 100

Answer

index=windows EventCode=* | where count > 100 | stats count by EventCode | sort - count

Question 6

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

Accepted Answer

Assets and Identity Data Model.. The Assets and Identity Data Model is the Splunk Common Information Model (CIM) data model that normalizes asset inventory and identity information — hostnames, IPs, MAC addresses, OS details, and user identities. CIS Control 1 (Inventory and Control of Enterprise Assets) requires knowing every device on the network, and this data model is purpose-built to provide that visibility. It is the essential model for tracking enterprise assets in Splunk.

Answer

Vulnerability Data Model.

Answer

Endpoint Data Model.

Answer

Network Traffic Data Model.

Question 7

During a proactive threat hunt, you want to quickly identify processes that were executed from a temporary directory such as C:\Users\Public on Windows endpoints, using Sysmon data. Which Splunk search is most appropriate to surface this activity?

Accepted Answer

index=sysmon EventCode=1 | where like(Image, "%\Users\Public\%"). Sysmon EventCode 1 is the process creation event and carries the Image field with the full path of the executable. Filtering on the Public directory isolates executions from a location where legitimate software rarely runs, which is a strong indicator of staging or malicious activity and directly supports the hunt hypothesis.

Answer

index=sysmon EventCode=11 | where like(TargetFilename, "%Public%")

Answer

index=sysmon EventCode=3 | where like(DestinationIp, "%Public%")

Answer

index=sysmon | stats count by Image | where count < 5

Question 8

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the "Command and Control" phase. Which of the following data sources would be most relevant for detecting command and control communications?

Accepted Answer

Firewall logs. Command and Control (C2) communications involve compromised hosts communicating with attacker-controlled infrastructure. Firewall logs provide visibility into network connections, including outbound traffic, which is essential for detecting C2 channels. By analyzing firewall logs for suspicious destinations, unusual ports, or beaconing behavior, analysts can identify C2 activity. Other data sources like endpoint or authentication logs may provide context but are not as directly relevant for network-based C2 detection.

Answer

Endpoint process execution logs

Answer

Authentication logs

Answer

Email gateway logs

Question 9

You are aligning your Splunk ES deployment with the NIST Cybersecurity Framework (CSF) to improve your organization's security posture. The CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Which TWO of the following Splunk ES capabilities most directly support the 'Respond' function? (Choose two.)

Accepted Answer

Incident review and collaboration tools. The Respond function of the NIST CSF focuses on taking action after a security event is detected. Splunk ES's incident review and collaboration tools facilitate investigation and coordination, while adaptive response actions enable automated containment and mitigation. Together, these capabilities directly support the Respond function by streamlining incident handling and executing response measures.

Answer

Asset and identity correlation for context enrichment

Answer

Threat intelligence framework for ingesting indicators

Answer

Risk analysis dashboard for prioritizing vulnerabilities

Question 10

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

Accepted Answer

Splunk App for CIS Benchmarks.. The Splunk App for CIS Benchmarks is the standard tool for ingesting and reporting CIS Benchmark compliance checks in Splunk. It provides pre-built dashboards, reports, and data models specifically for CIS compliance monitoring across various platforms, including Linux.

Answer

Splunk Add-on for Linux Auditd.

Answer

Splunk App for Infrastructure (SAI).

Answer

Splunk Enterprise Security Vulnerability Scanner.