SPLK-5001 Practice Questions 2 — 50 Questions

Question 1

You want to find the total count of events per hour over the last week. Which command sequence is most efficient?

Accepted Answer

bin _time span=1h | stats count by _time. Using 'bin' followed by 'stats' is the most efficient pattern.

Answer

chart count by _time | bucket 1h

Answer

stats count by _time_hour

Question 2

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

Accepted Answer

Improved focus on behavioral indicators. RBA reduces noise, prioritizes high-risk entities, and focuses on behavioral patterns.

Answer

Automatic remediation of threats

Answer

Automatic license management

Question 3

Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?

Accepted Answer

Hypothesis Generation. The 'Hypothesis Generation' phase involves determining what to hunt for based on threat intelligence or environmental observations.

Answer

Data Preparation

Answer

Reporting

Answer

Hunt Execution

Question 4

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

Accepted Answer

Endpoint. The Endpoint data model contains the 'process_path' and 'process_name' fields required for this comparison.

Answer

Authentication

Answer

Network Traffic

Answer

Change Analysis

Question 5

Which THREE of the following data sources are most valuable for detecting an insider threat?

Accepted Answer

Endpoint file activity. Insider threats are best monitored through access logs, file activity, and email traffic.

Answer

Printer toner levels

Answer

Router uptime logs

Question 6

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

Accepted Answer

Suspicious URL in email body. Phishing often uses suspicious sender domains and malicious embedded links.

Answer

Successful authentication

Answer

High CPU usage on server

Answer

Unusual printer activity

Question 7

Which TWO factors influence an object's final risk score in Splunk ES?

Accepted Answer

Individual risk event scores. The final score is influenced by the individual event scores and the aggregation method applied.

Answer

The number of users in the organization

Answer

The total disk space of the index

Answer

The operating system of the host

Question 8

Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?

Accepted Answer

Incident Review.. The Incident Review dashboard provides the interface for managing statuses, owners, and comments for notable events.

Answer

Asset and Identity Investigation.

Answer

Notable Event Suppression.

Answer

Risk Analysis Dashboard.

Question 9

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

Accepted Answer

The 'Authentication' Data Model.. The 'Authentication' data model is critical for tracking account usage, which is the primary method for lateral movement.

Answer

The 'Network Resolution' Data Model.

Answer

The 'Vulnerability' Data Model.

Answer

The 'Malware' Data Model.

Question 10

Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?

Accepted Answer

Settings > CIM Setup.. The CIM Setup page in the Splunk Web interface is the primary location for managing CIM data models and accelerations.

Answer

The local/inputs.conf file.

Answer

Splunk ES > Configure > Data Enrichment.

Answer

Settings > Data Model acceleration.

Question 11

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

Accepted Answer

The priority ranking in the Incident Review dashboard.. Urgency is a calculated value based on the risk of the event and the criticality of the assets involved, displayed in the Incident Review dashboard.

Answer

The frequency at which the search runs.

Answer

The retention period of the event.

Answer

The speed of the correlation search execution.

Question 12

Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?

Accepted Answer

The Search Head.. The 'Correlation Search' scheduler is the specific component that runs searches and triggers notable events.

Answer

The Forwarder.

Answer

The License Master.

Answer

The Indexer.

Question 13

In the context of Splunk ES, what is an 'Asset'?

Accepted Answer

An entity like a host or server.. An asset represents an entity in the environment, such as a host or server, which is stored in the asset and identity framework for context enrichment.

Answer

A malicious IP address.

Answer

A saved search report.

Answer

A notable event.

Question 14

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

Accepted Answer

It provides context to events.. It provides contextual information (like user departments or host ownership) to notable events, allowing for better prioritization and investigation.

Answer

It hides false positives.

Answer

It automatically generates risk scores.

Answer

It replaces the need for data models.

Question 15

Which THREE pieces of information are commonly found in a Splunk ES Case?

Accepted Answer

Investigation metadata (status, owner). Cases are containers that hold key artifacts, comments from analysts, and links to relevant notable events.

Answer

Raw indexer performance logs

Answer

System health metrics

Question 16

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Accepted Answer

Risk Message. The action allows configuration of the risk object, score, and message.

Answer

CPU core count

Answer

Network interface speed

Question 17

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

Accepted Answer

Set the TZ attribute in props.conf for the specific sourcetype.. Configuring the time zone in props.conf using TZ ensures that the _time field correctly reflects the event's actual time before correlation.

Answer

Modify the data model acceleration schedule.

Answer

Use an eval statement in the search to subtract hours.

Answer

Change the Splunk server time zone.

Question 18

What is the primary function of the 'Notable Event Suppression' feature?

Accepted Answer

To reduce alert fatigue from known false positives.. It allows users to prevent known false positives from creating notable events, reducing alert fatigue.

Answer

To automatically block malicious IPs.

Answer

To speed up correlation searches.

Answer

To archive old notable events.

Question 19

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

Accepted Answer

Severity. The dashboard displays core event information, including status and severity.

Answer

Raw file path

Answer

Cluster replication factor

Answer

License expiration date

Question 20

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

Accepted Answer

Use the 'owner' field in the notable event action configuration to map to an extracted user field.. The 'drilldown_field' and 'owner' field mapping in the notable event configuration allow for dynamic assignment based on extracted fields.

Answer

Assign the owner via a post-process lookup file.

Answer

Create separate correlation searches for each user.

Answer

Hardcode the owner name in the correlation search action.