SPLK-5001 Practice Test 6 — 10 Questions

Question 1

Which command is used to append results from one search to another?

Accepted Answer

append [search index=other]. The append command is correct because it takes the results of the current search and adds the results of a subsearch to the end of the result set, effectively combining two result sets vertically. The syntax append [search index=other] runs the subsearch and appends its output to the main pipeline. This is the standard Splunk command for concatenating results from separate searches without joining on a common field.

Answer

add [search index=other]

Answer

join [search index=other]

Answer

combine [search index=other]

Question 2

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

Accepted Answer

timechart. timechart is designed to plot aggregated values over time, making it ideal for visualizing the regularity of connections to a specific domain. By running timechart count by domain (or by dest), an analyst can see evenly spaced spikes that indicate beaconing intervals. This time-series view is exactly what C2 beacon detection requires.

Answer

stats

Answer

transaction

Answer

eval

Question 3

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

Accepted Answer

To alert when an object's risk score exceeds a threshold.. The Risk Notable correlation search in Splunk ES aggregates risk events per risk object and fires a notable when the summed risk score crosses a configured threshold. Its purpose is to convert accumulated risk into an actionable notable event for analysts, rather than to generate the underlying risk events themselves. This is the bridge between the risk framework and the Incident Review queue.

Answer

To clear old risk events from memory.

Answer

To generate risk events from logs.

Answer

To update the asset and identity table.

Question 4

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

To triage and manage notable events.. The Incident Review dashboard in Splunk Enterprise Security is the central triage workspace where analysts review, prioritize, and act on notable events generated by correlation searches. It provides filtering, sorting, and bulk actions so analysts can manage their queue efficiently. This makes 'triage and manage notable events' the correct purpose.

Answer

To manage threat intelligence feeds.

Answer

To configure data model acceleration.

Answer

To view real-time system health.

Question 5

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Accepted Answer

Asset and Identity framework using lookup tables.. The Asset and Identity framework in Splunk ES uses lookup tables to maintain authoritative records of assets (hardware, software, systems) and identities (users). For maintaining a current list of authorized software, the asset lookup table can include software inventory fields, and the framework supports scheduled updates from external sources. This aligns with the NIST CSF Identify function's goal of maintaining an inventory of authorized software (ID.AM-2).

Answer

Index-time field extraction.

Answer

Correlation search thresholding.

Answer

Dynamic Threat Intelligence updates.

Question 6

You are hunting for DNS-based data exfiltration using Splunk, where malware encodes stolen data in subdomain labels of queries to an attacker-controlled domain. Which two search constructs most directly help you quantify abnormally long or high-entropy query names and identify the destination domain being abused? (Choose two.)

Accepted Answer

Use rex to extract the query name into a field, then apply eval len() on the query and stats avg(len) by query to find unusually long names.. DNS exfiltration hides data in the length and variability of subdomain labels, so the strongest hunting constructs extract the query name and quantify its length and the number of unique subdomains per parent domain. Ranking parent domains by these metrics exposes the destination being abused and separates tunneling from ordinary resolution traffic without depending on pre-existing threat intelligence.

Answer

Use the lookup command with a threat intelligence feed of known malicious IP addresses and drop every DNS event whose source is not in the feed.

Answer

Use the dedup command on the query field to remove repeated queries and then count the remaining events per host to determine exfiltration volume.

Answer

Use the transaction command to group all DNS events from a single source IP over a 30-minute window into one event and inspect the raw payload.

Question 7

You need to modify the default 'Risk Score' logic for a specific asset. Where should this customization occur?

Accepted Answer

In the 'Risk Scoring' configuration or via lookup tables.. Risk score logic for a specific asset can be customized in the Risk Scoring configuration (via the Risk Analysis framework's settings) or by using lookup tables to override or adjust scores based on asset attributes. This allows per-asset tuning without modifying core ES code.

Answer

By changing the sourcetype definition.

Answer

In the 'limits.conf' file.

Answer

By editing the 'notable_event' python script.

Question 8

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

Accepted Answer

Use the 'owner' field in the notable event action configuration to map to an extracted user field.. The Notable adaptive response action in a correlation search includes an 'owner' configuration field where you can specify a token or field name (e.g., $user$ or $src_user$) that Splunk ES will resolve per-result. This means each triggered notable event gets its owner dynamically assigned based on the extracted user field from that specific result, correctly distributing ownership across multiple distinct users.

Answer

Assign the owner via a post-process lookup file.

Answer

Create separate correlation searches for each user.

Answer

Hardcode the owner name in the correlation search action.

Question 9

Which TWO types of events are typically categorized as 'Notable Events'?

Accepted Answer

Manually created incidents in Incident Review.. Option B is correct because manually created incidents in Incident Review are user-generated notable events; when an analyst creates an incident in Splunk Enterprise Security's Incident Review, it is stored as a notable event in the notable index and tracked through the investigation workflow. Option D is correct because correlation searches are the primary mechanism that generates notable events in Splunk ES; when a correlation search's triggering condition is met, it writes a notable event to the notable index for review in Incident Review. Option A is incorrect because the license master produces licensing-related internal messages (e.g., license violations or pool usage warnings), not notable events. Option C is incorrect because ordinary log events received by the indexer are raw indexed data, not notable events, unless a correlation search or manual action promotes them. Option E is incorrect because a user's browser history is endpoint/web data that would only become notable if a correlation search flagged it, not by its nature.

Answer

Events produced by the license master.

Answer

Every log event received by the indexer.

Answer

Browser history of a user.

Question 10

Which command is used to remove duplicate events based on a field?

Accepted Answer

dedup event_id. The dedup command removes duplicate events based on the specified field(s), keeping only the first occurrence (or a specified number with the keepevents/sortby options). 'dedup event_id' is the correct syntax to deduplicate events sharing the same event_id value. This is a core SPL command for reducing redundant results.

Answer

remove_duplicates event_id

Answer

distinct event_id

Answer

unique event_id