SPLK-5001 Practice Test 7 — 10 Questions

Question 1

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

Accepted Answer

The priority ranking in the Incident Review dashboard.. Urgency is a calculated value based on the risk of the event and the criticality of the assets involved, displayed in the Incident Review dashboard.

Answer

The frequency at which the search runs.

Answer

The retention period of the event.

Answer

The speed of the correlation search execution.

Question 2

Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?

Accepted Answer

The Search Head.. The 'Correlation Search' scheduler is the specific component that runs searches and triggers notable events.

Answer

The Forwarder.

Answer

The License Master.

Answer

The Indexer.

Question 3

In the context of Splunk ES, what is an 'Asset'?

Accepted Answer

An entity like a host or server.. An asset represents an entity in the environment, such as a host or server, which is stored in the asset and identity framework for context enrichment.

Answer

A malicious IP address.

Answer

A saved search report.

Answer

A notable event.

Question 4

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

Accepted Answer

It provides context to events.. It provides contextual information (like user departments or host ownership) to notable events, allowing for better prioritization and investigation.

Answer

It hides false positives.

Answer

It automatically generates risk scores.

Answer

It replaces the need for data models.

Question 5

Which THREE pieces of information are commonly found in a Splunk ES Case?

Accepted Answer

Investigation metadata (status, owner). Cases are containers that hold key artifacts, comments from analysts, and links to relevant notable events.

Answer

Raw indexer performance logs

Answer

System health metrics

Question 6

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Accepted Answer

Risk Message. The action allows configuration of the risk object, score, and message.

Answer

CPU core count

Answer

Network interface speed

Question 7

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

Accepted Answer

Set the TZ attribute in props.conf for the specific sourcetype.. Configuring the time zone in props.conf using TZ ensures that the _time field correctly reflects the event's actual time before correlation.

Answer

Modify the data model acceleration schedule.

Answer

Use an eval statement in the search to subtract hours.

Answer

Change the Splunk server time zone.

Question 8

What is the primary function of the 'Notable Event Suppression' feature?

Accepted Answer

To reduce alert fatigue from known false positives.. It allows users to prevent known false positives from creating notable events, reducing alert fatigue.

Answer

To automatically block malicious IPs.

Answer

To speed up correlation searches.

Answer

To archive old notable events.

Question 9

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

Accepted Answer

Severity. The dashboard displays core event information, including status and severity.

Answer

Raw file path

Answer

Cluster replication factor

Answer

License expiration date

Question 10

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

Accepted Answer

Use the 'owner' field in the notable event action configuration to map to an extracted user field.. The 'drilldown_field' and 'owner' field mapping in the notable event configuration allow for dynamic assignment based on extracted fields.

Answer

Assign the owner via a post-process lookup file.

Answer

Create separate correlation searches for each user.

Answer

Hardcode the owner name in the correlation search action.