SPLK-5001 Practice Questions 2 — 50 Questions

Question 1

Which command is used to append results from one search to another?

Accepted Answer

append [search index=other]. The append command is correct because it takes the results of the current search and adds the results of a subsearch to the end of the result set, effectively combining two result sets vertically. The syntax append [search index=other] runs the subsearch and appends its output to the main pipeline. This is the standard Splunk command for concatenating results from separate searches without joining on a common field.

Answer

add [search index=other]

Answer

join [search index=other]

Answer

combine [search index=other]

Question 2

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

Accepted Answer

timechart. timechart is designed to plot aggregated values over time, making it ideal for visualizing the regularity of connections to a specific domain. By running timechart count by domain (or by dest), an analyst can see evenly spaced spikes that indicate beaconing intervals. This time-series view is exactly what C2 beacon detection requires.

Answer

stats

Answer

transaction

Answer

eval

Question 3

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

Accepted Answer

To alert when an object's risk score exceeds a threshold.. The Risk Notable correlation search in Splunk ES aggregates risk events per risk object and fires a notable when the summed risk score crosses a configured threshold. Its purpose is to convert accumulated risk into an actionable notable event for analysts, rather than to generate the underlying risk events themselves. This is the bridge between the risk framework and the Incident Review queue.

Answer

To clear old risk events from memory.

Answer

To generate risk events from logs.

Answer

To update the asset and identity table.

Question 4

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

To triage and manage notable events.. The Incident Review dashboard in Splunk Enterprise Security is the central triage workspace where analysts review, prioritize, and act on notable events generated by correlation searches. It provides filtering, sorting, and bulk actions so analysts can manage their queue efficiently. This makes 'triage and manage notable events' the correct purpose.

Answer

To manage threat intelligence feeds.

Answer

To configure data model acceleration.

Answer

To view real-time system health.

Question 5

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Accepted Answer

Asset and Identity framework using lookup tables.. The Asset and Identity framework in Splunk ES uses lookup tables to maintain authoritative records of assets (hardware, software, systems) and identities (users). For maintaining a current list of authorized software, the asset lookup table can include software inventory fields, and the framework supports scheduled updates from external sources. This aligns with the NIST CSF Identify function's goal of maintaining an inventory of authorized software (ID.AM-2).

Answer

Index-time field extraction.

Answer

Correlation search thresholding.

Answer

Dynamic Threat Intelligence updates.

Question 6

You are hunting for DNS-based data exfiltration using Splunk, where malware encodes stolen data in subdomain labels of queries to an attacker-controlled domain. Which two search constructs most directly help you quantify abnormally long or high-entropy query names and identify the destination domain being abused? (Choose two.)

Accepted Answer

Use rex to extract the query name into a field, then apply eval len() on the query and stats avg(len) by query to find unusually long names.. DNS exfiltration hides data in the length and variability of subdomain labels, so the strongest hunting constructs extract the query name and quantify its length and the number of unique subdomains per parent domain. Ranking parent domains by these metrics exposes the destination being abused and separates tunneling from ordinary resolution traffic without depending on pre-existing threat intelligence.

Answer

Use the lookup command with a threat intelligence feed of known malicious IP addresses and drop every DNS event whose source is not in the feed.

Answer

Use the dedup command on the query field to remove repeated queries and then count the remaining events per host to determine exfiltration volume.

Answer

Use the transaction command to group all DNS events from a single source IP over a 30-minute window into one event and inspect the raw payload.

Question 7

You need to modify the default 'Risk Score' logic for a specific asset. Where should this customization occur?

Accepted Answer

In the 'Risk Scoring' configuration or via lookup tables.. Risk score logic for a specific asset can be customized in the Risk Scoring configuration (via the Risk Analysis framework's settings) or by using lookup tables to override or adjust scores based on asset attributes. This allows per-asset tuning without modifying core ES code.

Answer

By changing the sourcetype definition.

Answer

In the 'limits.conf' file.

Answer

By editing the 'notable_event' python script.

Question 8

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

Accepted Answer

Use the 'owner' field in the notable event action configuration to map to an extracted user field.. The Notable adaptive response action in a correlation search includes an 'owner' configuration field where you can specify a token or field name (e.g., $user$ or $src_user$) that Splunk ES will resolve per-result. This means each triggered notable event gets its owner dynamically assigned based on the extracted user field from that specific result, correctly distributing ownership across multiple distinct users.

Answer

Assign the owner via a post-process lookup file.

Answer

Create separate correlation searches for each user.

Answer

Hardcode the owner name in the correlation search action.

Question 9

Which TWO types of events are typically categorized as 'Notable Events'?

Accepted Answer

Manually created incidents in Incident Review.. Option B is correct because manually created incidents in Incident Review are user-generated notable events; when an analyst creates an incident in Splunk Enterprise Security's Incident Review, it is stored as a notable event in the notable index and tracked through the investigation workflow. Option D is correct because correlation searches are the primary mechanism that generates notable events in Splunk ES; when a correlation search's triggering condition is met, it writes a notable event to the notable index for review in Incident Review. Option A is incorrect because the license master produces licensing-related internal messages (e.g., license violations or pool usage warnings), not notable events. Option C is incorrect because ordinary log events received by the indexer are raw indexed data, not notable events, unless a correlation search or manual action promotes them. Option E is incorrect because a user's browser history is endpoint/web data that would only become notable if a correlation search flagged it, not by its nature.

Answer

Events produced by the license master.

Answer

Every log event received by the indexer.

Answer

Browser history of a user.

Question 10

Which command is used to remove duplicate events based on a field?

Accepted Answer

dedup event_id. The dedup command removes duplicate events based on the specified field(s), keeping only the first occurrence (or a specified number with the keepevents/sortby options). 'dedup event_id' is the correct syntax to deduplicate events sharing the same event_id value. This is a core SPL command for reducing redundant results.

Answer

remove_duplicates event_id

Answer

distinct event_id

Answer

unique event_id

Question 11

An analyst notices a Windows workstation repeatedly resolving long, random-looking subdomains under a single parent domain, followed by outbound DNS TXT queries. Which Splunk ES detection method is most appropriate to identify this as DNS tunneling?

Accepted Answer

Use the Network_Traffic data model with a search that aggregates the length of DNS query names and the count of unique subdomains per parent domain, then apply a threshold-based correlation search.. DNS tunneling encodes data in query names and record types, producing long, random-looking subdomains and frequent TXT queries to one parent domain. The Network_Traffic data model holds DNS events and supports aggregation of query name length and unique subdomain counts per parent, making a threshold-based correlation search the reliable way to flag this behavior.

Answer

Use the Endpoint data model to look for process execution of signed system binaries that spawn child processes outside their normal parent.

Answer

Use the Authentication data model to count failed logons per hour and trigger an alert when the count exceeds a baseline.

Answer

Use the Web data model to search for HTTP POST requests containing base64-encoded parameters sent to a small set of external IPs.

Question 12

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Accepted Answer

Host/Asset context. The Asset and Identity framework in Splunk ES is designed to correlate events with contextual metadata about hosts and users, so option A (Host/Asset context) is correct because it enriches events with asset attributes such as IP, MAC, hostname, priority, and business unit. Option C (User identity information) is also correct because the framework enriches events with identity attributes like user name, email, department, and role, enabling risk scoring and correlation. Options B, D, and E are not part of the framework's enrichment: encrypted packet captures are raw network data, raw web server application logs are source events rather than enrichment lookups, and system performance statistics are metrics not typically provided by asset or identity lookups.

Answer

Encrypted packet captures

Answer

Raw web server application logs

Answer

System performance statistics

Question 13

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

Accepted Answer

The priority ranking in the Incident Review dashboard.. In Splunk Enterprise Security, the 'Urgency' field on a notable event is a normalized severity indicator (informational, low, medium, high, critical) that drives the priority ranking and sort order within the Incident Review dashboard. It is populated by the correlation search's adaptive response action (e.g., 'risk' or 'notable' action) based on the 'urgency' argument set in the saved search. It does not affect scheduling, retention, or execution speed — those are governed by other settings.

Answer

The frequency at which the search runs.

Answer

The retention period of the event.

Answer

The speed of the correlation search execution.

Question 14

What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?

Accepted Answer

It determines how long data remains in the Notable event storage.. The Retention Period setting in Splunk Enterprise Security controls how long notable events and their associated metadata are retained in the notable event storage (the KV Store-backed index). Changing it adjusts the lifespan of these records before they are purged, directly affecting how far back analysts can review or investigate prior notables. It does not affect raw data retention, licensing, or user permissions.

Answer

It changes the user access level.

Answer

It changes the search speed.

Answer

It increases the license limit.

Question 15

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Accepted Answer

Select the event in Incident Review and choose 'Add to Case'.. In Splunk Enterprise Security, the Incident Review dashboard is the primary triage interface where analysts view notable events and can take actions on them. To manually add an event to an existing case, the analyst selects the event within Incident Review and uses the 'Add to Case' action, which associates that event with the chosen case for investigation. This is the documented, supported workflow for enriching a case with additional evidence.

Answer

Edit the correlation search definition.

Answer

Modify the risk index directly.

Answer

Use the Case Management dashboard to search for the event ID.

Question 16

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

Accepted Answer

To align with attacker dwell time. The primary purpose of a 'Lookback' period in threat hunting is to align with attacker dwell time, which is the time an attacker remains undetected in a network. By setting a lookback period that covers the typical dwell time, hunters can search for indicators of compromise over a relevant historical window, increasing the chances of detecting ongoing or past intrusions.

Answer

To increase the search speed

Answer

To clear the cache

Answer

To reduce the number of false positives

Question 17

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

Accepted Answer

Correlation Search Editor. The Correlation Search Editor is the ES component used to create, edit, and manage correlation searches, including those that match events against a custom blacklist of domains. You define the search logic, schedule, throttling, and notable event settings here. It is the correct place to author a new rule that leverages a lookup or KV Store blacklist for domain matching.

Answer

Notable Event Suppressor

Answer

Risk Analysis Configuration

Answer

Threat Intelligence Framework

Question 18

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

Accepted Answer

dest. The Splunk Common Information Model (CIM) standardizes field names to enable consistent searching and reporting across diverse data sources. For network traffic data models, the CIM specifies 'dest' as the canonical field for the destination IP address. This normalization allows analysts to write a single search (e.g., `| tstats ... where nodename=All_Traffic`) that works regardless of whether the underlying source used 'dst_ip', 'remote_address', or 'target_ip'. Option C is correct because 'dest' is the exact field name defined in the CIM's Network Traffic data model.

Answer

dst_ip

Answer

remote_address

Answer

target_ip

Question 19

What is the result of using 'bin _time span=1d'?

Accepted Answer

Groups events into 24-hour buckets.. The 'bin _time span=1d' command groups events into 24-hour buckets based on the _time field, effectively discretizing timestamps into daily intervals. It does not count events by itself; it creates a binned _time field that can then be used with stats, timechart, or other aggregations. The result is that events are assigned to day-long buckets for grouping.

Answer

Counts events per day.

Answer

Deletes events older than 1 day.

Answer

Changes the display format of the timestamp.

Question 20

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

Accepted Answer

Correlation Search Editor. The Correlation Search Editor is where you configure all aspects of a correlation search, including its risk score (risk analysis settings) and urgency. Adjusting the sensitivity of a specific correlation search means editing its risk score or risk object configuration, which is done in this editor. It provides the per-search control needed to tune detection sensitivity.

Answer

Notable Event Settings

Answer

Incident Review

Answer

Risk Analysis Dashboard