SPLK-5001 Practice Test 7 — 10 Questions

Question 1

An analyst notices a Windows workstation repeatedly resolving long, random-looking subdomains under a single parent domain, followed by outbound DNS TXT queries. Which Splunk ES detection method is most appropriate to identify this as DNS tunneling?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Network_Traffic data model with a search that aggregates the length of DNS query names and the count of unique subdomains per parent domain, then apply a threshold-based correlation search.. DNS tunneling encodes data in query names and record types, producing long, random-looking subdomains and frequent TXT queries to one parent domain. The Network_Traffic data model holds DNS events and supports aggregation of query name length and unique subdomain counts per parent, making a threshold-based correlation search the reliable way to flag this behavior.

Answer

Use the Endpoint data model to look for process execution of signed system binaries that spawn child processes outside their normal parent.

Answer

Use the Authentication data model to count failed logons per hour and trigger an alert when the count exceeds a baseline.

Answer

Use the Web data model to search for HTTP POST requests containing base64-encoded parameters sent to a small set of external IPs.

Question 2

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Accepted Answer

Host/Asset context. The Asset and Identity framework in Splunk ES is designed to correlate events with contextual metadata about hosts and users, so option A (Host/Asset context) is correct because it enriches events with asset attributes such as IP, MAC, hostname, priority, and business unit. Option C (User identity information) is also correct because the framework enriches events with identity attributes like user name, email, department, and role, enabling risk scoring and correlation. Options B, D, and E are not part of the framework's enrichment: encrypted packet captures are raw network data, raw web server application logs are source events rather than enrichment lookups, and system performance statistics are metrics not typically provided by asset or identity lookups.

Answer

Encrypted packet captures

Answer

Raw web server application logs

Answer

System performance statistics

Question 3

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

Accepted Answer

The priority ranking in the Incident Review dashboard.. In Splunk Enterprise Security, the 'Urgency' field on a notable event is a normalized severity indicator (informational, low, medium, high, critical) that drives the priority ranking and sort order within the Incident Review dashboard. It is populated by the correlation search's adaptive response action (e.g., 'risk' or 'notable' action) based on the 'urgency' argument set in the saved search. It does not affect scheduling, retention, or execution speed — those are governed by other settings.

Answer

The frequency at which the search runs.

Answer

The retention period of the event.

Answer

The speed of the correlation search execution.

Question 4

What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?

Accepted Answer

It determines how long data remains in the Notable event storage.. The Retention Period setting in Splunk Enterprise Security controls how long notable events and their associated metadata are retained in the notable event storage (the KV Store-backed index). Changing it adjusts the lifespan of these records before they are purged, directly affecting how far back analysts can review or investigate prior notables. It does not affect raw data retention, licensing, or user permissions.

Answer

It changes the user access level.

Answer

It changes the search speed.

Answer

It increases the license limit.

Question 5

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Accepted Answer

Select the event in Incident Review and choose 'Add to Case'.. In Splunk Enterprise Security, the Incident Review dashboard is the primary triage interface where analysts view notable events and can take actions on them. To manually add an event to an existing case, the analyst selects the event within Incident Review and uses the 'Add to Case' action, which associates that event with the chosen case for investigation. This is the documented, supported workflow for enriching a case with additional evidence.

Answer

Edit the correlation search definition.

Answer

Modify the risk index directly.

Answer

Use the Case Management dashboard to search for the event ID.

Question 6

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

Accepted Answer

To align with attacker dwell time. The primary purpose of a 'Lookback' period in threat hunting is to align with attacker dwell time, which is the time an attacker remains undetected in a network. By setting a lookback period that covers the typical dwell time, hunters can search for indicators of compromise over a relevant historical window, increasing the chances of detecting ongoing or past intrusions.

Answer

To increase the search speed

Answer

To clear the cache

Answer

To reduce the number of false positives

Question 7

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

Accepted Answer

Correlation Search Editor. The Correlation Search Editor is the ES component used to create, edit, and manage correlation searches, including those that match events against a custom blacklist of domains. You define the search logic, schedule, throttling, and notable event settings here. It is the correct place to author a new rule that leverages a lookup or KV Store blacklist for domain matching.

Answer

Notable Event Suppressor

Answer

Risk Analysis Configuration

Answer

Threat Intelligence Framework

Question 8

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

Accepted Answer

dest. The Splunk Common Information Model (CIM) standardizes field names to enable consistent searching and reporting across diverse data sources. For network traffic data models, the CIM specifies 'dest' as the canonical field for the destination IP address. This normalization allows analysts to write a single search (e.g., `| tstats ... where nodename=All_Traffic`) that works regardless of whether the underlying source used 'dst_ip', 'remote_address', or 'target_ip'. Option C is correct because 'dest' is the exact field name defined in the CIM's Network Traffic data model.

Answer

dst_ip

Answer

remote_address

Answer

target_ip

Question 9

What is the result of using 'bin _time span=1d'?

Accepted Answer

Groups events into 24-hour buckets.. The 'bin _time span=1d' command groups events into 24-hour buckets based on the _time field, effectively discretizing timestamps into daily intervals. It does not count events by itself; it creates a binned _time field that can then be used with stats, timechart, or other aggregations. The result is that events are assigned to day-long buckets for grouping.

Answer

Counts events per day.

Answer

Deletes events older than 1 day.

Answer

Changes the display format of the timestamp.

Question 10

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

Accepted Answer

Correlation Search Editor. The Correlation Search Editor is where you configure all aspects of a correlation search, including its risk score (risk analysis settings) and urgency. Adjusting the sensitivity of a specific correlation search means editing its risk score or risk object configuration, which is done in this editor. It provides the per-search control needed to tune detection sensitivity.

Answer

Notable Event Settings

Answer

Incident Review

Answer

Risk Analysis Dashboard