SPLK-5001 Practice Test 5 — 10 Questions

Question 1

What is the purpose of the 'head' command?

Accepted Answer

Return the first N results.. The 'head' command returns the first N results from a search.

Answer

Return the last N results.

Answer

Sort the results.

Answer

Count the results.

Question 2

You are investigating a potential data exfiltration event. You have a lookup file called 'authorized_servers.csv' containing a field 'ip_address'. You want to find all connections to IPs not in this list. Which command fulfills this?

Accepted Answer

index=network | lookup authorized_servers.csv ip_address AS dest_ip OUTPUT ip_address as is_authorized | where is_authorized="". The 'inputlookup' combined with 'NOT [search]' or the 'lookup' command with a filter is used for exclusion.

Answer

index=network | inputlookup authorized_servers.csv | where dest_ip!=ip_address

Answer

index=network | lookup authorized_servers.csv dest_ip | where isnull(dest_ip)

Answer

index=network | filter dest_ip NOT IN authorized_servers.csv

Question 3

Which TWO of the following are common types of social engineering?

Accepted Answer

Pretexting. Phishing and pretexting are classic examples of social engineering techniques.

Answer

Buffer Overflow

Answer

SQL Injection

Answer

Port Scanning

Question 4

You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?

Accepted Answer

$SPLUNK_HOME/etc/apps/<app_name>/bin. The script must be placed in the 'bin' directory of the specific Add-on or app directory to be accessible by the Splunk search process.

Answer

The root of the Splunk installation directory.

Answer

/etc/system/bin

Answer

/var/lib/splunk/scripts

Question 5

When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?

Accepted Answer

Use the CIM Validator app to check compliance against the data model.. Using the CIM Validator app or running a search with the 'datamodel' command allows you to verify if the fields match the CIM requirements.

Answer

Disable and re-enable the Enterprise Security app.

Answer

Change the sourcetype to 'cisco_asa' manually.

Answer

Re-index all firewall logs from the past 30 days.

Question 6

Which THREE components are required for an Adaptive Response action to function?

Accepted Answer

The Adaptive Response action must be enabled.. Adaptive response requires an enabled action, a configured Add-on (for the target system), and proper credentials.

Answer

A permanent connection to the Internet.

Answer

A user with 'Admin' role on all indexers.

Question 7

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

Accepted Answer

Using the 'lookup' command against a KV Store collection.. Threat intel can be added via the 'Threat Intelligence' framework (using KV Store lookups) or by using standard 'lookup' commands against threat feeds.

Answer

By changing the user's password.

Answer

By editing the indexer's configuration files.

Answer

By deleting the old notable events.

Question 8

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

Accepted Answer

eval decoded=base64_decode(field). The 'base64_decode' function in SPL is designed to handle this specific transformation.

Answer

rex field=field "(?<decoded>.*)"

Answer

transform base64 field

Answer

eval decoded=decode(field, "base64")

Question 9

A security analyst needs to reduce the noise generated by a specific correlation search that triggers too frequently for authorized internal vulnerability scanners. What is the most efficient way to handle this in Splunk ES?

Accepted Answer

Use the Notable Event Suppression feature within the Incident Review dashboard.. Notable event suppression allows analysts to define criteria where events matching specific patterns (like a known scanner IP) are ignored, preventing them from appearing as notable events.

Answer

Disable the correlation search and create a new one with an exclusion filter.

Answer

Modify the search logic to use an 'eval' statement to filter out the scanner IP address.

Answer

Change the risk score of the notable event to zero in the correlation search configuration.

Question 10

You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?

Accepted Answer

search dest_ip=x.x.x.x | streamstats current=f window=2 global=f last(_time) as prev_time | eval diff=_time - prev_time. The streamstats command allows for calculating intervals between events, which is critical for identifying beaconing patterns in network traffic.

Answer

search dest_ip=x.x.x.x | rare dest_ip

Answer

search dest_ip=x.x.x.x | timechart span=1h count

Answer

search dest_ip=x.x.x.x | stats count by _time