SPLK-5001 Practice Test 8 — 10 Questions

Question 1

During a hunt for compromised accounts, you want to distinguish a legitimate helpdesk password reset from an attacker resetting credentials to retain access. Which correlation of events in Splunk would best support that distinction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Correlate Event ID 4724 (password reset attempt) with the initiating account and compare the target account's subsequent logon source IPs against its historical baseline. Password reset activity is captured by Event ID 4724, which includes the account performing the reset. The key discriminator is what happens next: if the target account subsequently authenticates from source addresses outside its historical pattern, the reset likely served attacker access retention rather than routine support. Correlating the reset actor with the target's later logon geography turns a benign-looking event into a defensible finding.

Answer

Correlate Event ID 4688 process creation with Event ID 5156 network connection allowed and group by parent process

Answer

Correlate Event ID 4768 with Event ID 4769 and count ticket requests per account within a five-minute window

Answer

Correlate Event ID 4624 logon type 3 with Event ID 4672 special privileges assigned and group by destination host

Question 2

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

Accepted Answer

The search logic does not match the data.. A correlation search that runs successfully but returns 0 results indicates the search's filtering conditions (e.g., field values, thresholds, time windows, or index/sourcetype references) don't match any events in the data. Since the search executes without error, the issue is with the logic-to-data alignment, not infrastructure or permissions.

Answer

The Splunk indexer is overloaded.

Answer

The user does not have permission to write to the risk index.

Answer

The Risk Analysis action is disabled.

Question 3

You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?

Accepted Answer

The input configuration within the Splunk Add-on for Microsoft Windows.. The Splunk Add-on for Microsoft Windows (TA-windows) contains the field extractions, event type definitions, and CIM-compliant tag mappings that normalize Windows Event Log data (e.g., EventCode 4624, 4625) into the Authentication data model's required fields like src, user, dest, and action. Sourcetype configuration and CIM tagging for Windows events are handled at the input/props level within this add-on, so it is the primary place to ensure data conforms to the CIM.

Answer

The data model acceleration settings in the ES app settings.

Answer

The index-time index routing configuration in indexes.conf.

Answer

The Notable Event Suppression configuration in Splunk ES.

Question 4

Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?

Accepted Answer

Search Macro. A Search Macro in Splunk allows you to save a search query with variables (arguments) that can be reused across different searches, time ranges, and entities. It supports parameterization, enabling analysts to define placeholders that are replaced at runtime, making it ideal for reusable and dynamic searches.

Answer

Saved Search

Answer

Data Model Acceleration

Answer

Event Type

Question 5

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

Accepted Answer

The scores are additive.. When the Risk Analysis framework uses the 'sum' aggregation method, risk scores from multiple risk events for the same object within the same time window are added together. This additive behavior means an object with three risk events scoring 20, 30, and 50 would have a total risk score of 100 for that window.

Answer

Only the highest score is kept.

Answer

The scores are averaged.

Answer

The risk score is reset to zero.

Question 6

When using 'stats', how can you include the values of a field as columns in your output?

Accepted Answer

stats count by host, sourcetype | xyseries host, sourcetype, count. The xyseries command converts the results of a stats aggregation into a matrix (pivot) format, using one field for rows, another for column headers, and a numeric field for cell values. In this case, 'stats count by host, sourcetype' produces rows of (host, sourcetype, count), and 'xyseries host, sourcetype, count' pivots sourcetype values into distinct columns with counts as cell values. This is the canonical SPL way to turn grouped stats output into a wide table with field values as column headers.

Answer

stats count by host, sourcetype

Answer

stats count by host | transpose

Answer

stats pivot host sourcetype

Question 7

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

Accepted Answer

Enable acceleration and define a summary range.. To use a data model for notable event generation in ES, you must enable acceleration and define a summary range, because ES correlation searches rely on accelerated data models for performance. Acceleration creates summary data that the data model can query quickly, and the summary range determines how far back the summaries are retained.

Answer

Configure the data model to use only indexed fields.

Answer

Set the data model to root-level permissions only.

Answer

Manually create tags for every field in the data model.

Question 8

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

Accepted Answer

Event ID 1. Sysmon Event ID 1 is the 'Process Create' event, which logs the full command line, image path, parent process, user, and hashes for every process launched. For detecting living-off-the-land techniques (e.g., powershell.exe, wmic.exe, certutil.exe with suspicious arguments), Event ID 1 is the definitive source for command-line arguments.

Answer

Event ID 7

Answer

Event ID 2

Answer

Event ID 5

Question 9

When dealing with multi-value fields, which command allows you to break them into individual events?

Accepted Answer

mvexpand field_name. The mvexpand command takes a multi-value field and expands each value into its own separate event, duplicating the other fields for each value. This is the standard SPL command for breaking multi-value fields into individual events, and it is commonly used before further aggregation or correlation.

Answer

expand field_name

Answer

mv_to_events field_name

Answer

split field_name

Question 10

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

Accepted Answer

Hunt Procedure and Query Logic. The Hunt Procedure and Query Logic section documents the exact steps, SPL queries, data sources, and expected outputs of the hunt. This is what makes the playbook repeatable by another analyst and auditable later, because it captures the reproducible method rather than just the outcome. Without it, the playbook is not a procedure.

Answer

Threat Intelligence Source List

Answer

Executive Summary

Answer

Hardware Requirements