SPLK-5001 Practice Test 8 — 10 Questions

Question 1

Which dashboard in Splunk ES provides a high-level view of threats and vulnerabilities mapped to the MITRE ATT&CK framework?

Accepted Answer

Security Posture.. The Security Posture dashboard and the MITRE ATT&CK mapping dashboard are standard features for viewing framework coverage.

Answer

Asset Discovery.

Answer

Threat Intelligence Manager.

Answer

Incident Review.

Question 2

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Accepted Answer

The 'Notable' adaptive response action is not enabled in the search configuration.. The 'Notable' adaptive response action must be enabled in the correlation search configuration for it to generate an entry in the Incident Review dashboard.

Answer

The correlation search schedule is set to 'Real-time'.

Answer

The user does not have the 'ess_admin' role.

Answer

The data model acceleration is lagging.

Question 3

You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?

Accepted Answer

spath input=raw_data. The 'spath' command is specifically designed to parse JSON or XML data.

Answer

eval json_parse(raw_data)

Answer

json raw_data

Answer

extract json raw_data

Question 4

Which command is used to remove duplicate events based on a field?

Accepted Answer

dedup event_id. The 'dedup' command is specifically for removing duplicates.

Answer

remove_duplicates event_id

Answer

distinct event_id

Answer

unique event_id

Question 5

Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?

Accepted Answer

Submit the hash to an external sandbox/reputation service. Checking against threat intelligence and using online reputation services are standard methods.

Answer

Restart the endpoint

Answer

Rename the file

Answer

Change the file extension

Question 6

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Accepted Answer

Select the event in Incident Review and choose 'Add to Case'.. From the Incident Review dashboard, analysts can select a notable event and use the 'Action' menu to assign it to an existing case.

Answer

Edit the correlation search definition.

Answer

Modify the risk index directly.

Answer

Use the Case Management dashboard to search for the event ID.

Question 7

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

To triage and manage notable events.. It serves as the central hub for security analysts to triage, investigate, and manage notable events.

Answer

To manage threat intelligence feeds.

Answer

To configure data model acceleration.

Answer

To view real-time system health.

Question 8

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Accepted Answer

Correlation Search Editor. Risk rules are often defined within the correlation search itself, where the risk score is mapped to the event severity.

Answer

Identity Manager

Answer

Risk Index Configuration

Answer

Risk Notable Settings

Question 9

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Accepted Answer

Correlation Search Suppression. Notable event suppression is the native method in Splunk ES to prevent specific event types from triggering notables based on criteria.

Answer

Risk Index Retention Policy

Answer

Data Model Acceleration

Answer

Asset and Identity Table

Question 10

Which TWO factors are critical for effective Asset and Identity enrichment?

Accepted Answer

The consistency of the source data files.. The quality of the input data (CSV/KV Store) and the accuracy of the matching fields (like IP or user) are critical.

Answer

The physical location of the Splunk indexer.

Answer

The number of colors used in the dashboard.

Answer

The version of the OS running on the search head.