SPLK-5001 Practice Test 9 — 10 Questions

Question 1

A security analyst is documenting the lifecycle of an investigation in Splunk Enterprise Security. Which statement accurately describes how cases and notables relate within that lifecycle?

Accepted Answer

A notable can be added to a case, and a single case can contain multiple notables and associated events.. Cases serve as containers for investigations and can include multiple notables along with related events and artifacts. Analysts add notables to a case to group related findings, enabling coordinated analysis, evidence collection, and documentation. This relationship supports the workflow of triaging individual notables and then consolidating related ones into a single investigative record.

Answer

A case is automatically created for every notable event generated by a correlation search.

Answer

Closing a case automatically closes all notables that were added to it, preventing further review.

Answer

Notables and cases are stored in the same index and are distinguished only by their source type.

Question 2

During a threat hunt for data exfiltration, you want to identify endpoints that transferred an unusually large volume of data to external IP addresses compared to their normal baseline. Which Splunk approach best accomplishes this using the Network_Traffic data model?

Accepted Answer

Use tstats to compute per-host outbound bytes from Network_Traffic.All_Traffic, then compare each host's recent total to its historical average and flag significant deviations.. Exfiltration detection hinges on identifying hosts whose outbound transfer volume deviates from their own historical norm. Aggregating bytes per host through the accelerated Network_Traffic data model and comparing recent totals to a baseline surfaces those deviations efficiently, while static thresholds or unrelated DNS signals fail to capture the volume anomaly.

Answer

Search for DNS queries to newly registered domains and assume any resolution indicates exfiltration.

Answer

Run a raw search over index=firewall and manually review the top talkers by bytes for the past hour.

Answer

Create an alert that fires whenever any host sends more than 1 GB in an hour, regardless of its typical usage.

Question 3

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

Accepted Answer

In the 'Comments' section of the Case.. In Splunk Enterprise Security, the Case Management feature provides a 'Comments' section where analysts can document investigation findings, and these comments are stored with the case and visible to all team members who have access to the case. This ensures collaboration and continuity across shifts.

Answer

In the splunkd.log file.

Answer

By modifying the correlation search.

Answer

In the Asset and Identity manager.

Question 4

A SOC manager wants to ensure that when a notable event is reviewed and closed, the analyst's disposition and any supporting evidence are preserved for audit purposes. Which Splunk ES feature should the manager use to capture this information?

Accepted Answer

Notable event comments and status updates in the Incident Review dashboard.. Incident Review is the central place where analysts document their investigation of notable events. Comments, status changes, and ownership updates are stored with the notable, creating an audit trail of the disposition and evidence. This satisfies the requirement to preserve review outcomes for audit purposes without additional tooling.

Answer

The `_internal` index, which logs all notable event status changes and comments.

Answer

The Search & Reporting app's saved search history for the correlation search that generated the notable.

Answer

The Audit trail in Splunk ES settings, which records all configuration changes to correlation searches.

Question 5

You are building a correlation search that must trigger a notable event when a user's risk score exceeds 100 within a 24-hour period. The risk score is calculated from multiple risk events across different indexes. Which Splunk ES component should you use to aggregate the risk events and evaluate the threshold?

Accepted Answer

Risk Analysis framework with a correlation search using the 'risk' index. The Risk Analysis framework is designed to collect risk events into the 'risk' index, where they can be aggregated and analyzed. A correlation search can then query the 'risk' index, sum risk scores by user over a 24-hour window, and trigger a notable when the total exceeds 100. This approach leverages the built-in risk framework and is the correct way to implement risk-based alerting in Splunk ES.

Answer

Threat Intelligence framework with a lookup of known malicious users

Answer

Incident Review dashboard with a custom filter for risk score

Answer

Data Model acceleration on the Risk data model

Question 6

Which search command is used to join threat intelligence data with your local search results?

Accepted Answer

lookup. The lookup command is the standard SPL command for enriching local search results with external data, including threat intelligence lookups. It matches fields in the event stream against a lookup table (CSV, KV Store, or external) and returns additional fields, making it the correct tool for joining threat intel with local results.

Answer

join

Answer

map

Answer

append

Question 7

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

Accepted Answer

Risk Analysis configuration in ES Settings.. The risk score lifespan (decay) is configured in the Risk Analysis configuration within ES Settings. This setting defines how long risk events contribute to an object's risk score before decaying, and it controls the decay rate applied to risk scores over time. If decay is not occurring, this configuration is where to investigate.

Answer

Data model acceleration TTL.

Answer

Search Scheduler settings.

Answer

Notable event retention settings.

Question 8

You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?

Accepted Answer

outputlookup ioc_list.csv. The outputlookup command is used to write search results to a lookup table file, such as a CSV. It takes the results of the current search and outputs them to the specified lookup file, dynamically updating it with new IOCs. This is the standard method for updating lookup tables from search results.

Answer

saveas lookup ioc_list.csv

Answer

write ioc_list.csv

Answer

inputlookup ioc_list.csv --append

Question 9

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

Accepted Answer

Endpoint. The Endpoint data model is designed to capture process execution, command-line arguments, and script block logging on hosts, which are essential for detecting obfuscated PowerShell. It includes fields like process, process_name, and process_exec that store the full command line, allowing you to search for encoded commands (e.g., -EncodedCommand). Since PowerShell obfuscation occurs at the endpoint level, this data model provides the necessary context to identify and investigate such activity.

Answer

Network Sessions

Answer

Web

Answer

Authentication

Question 10

You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?

Accepted Answer

Subsearches are limited by the 'maxout' configuration and execution time.. Subsearches in Splunk are constrained by the 'maxout' setting (default 50,000 results) which caps how many results the subsearch can return to the outer search, and by subsearch execution time limits (default 60 seconds via 'maxtime'). Exceeding either causes the subsearch to be truncated or aborted, silently dropping results and producing incomplete correlation.

Answer

Subsearches only return the first 10 results.

Answer

Subsearches cannot use the 'stats' command.

Answer

Subsearches cannot reference fields from the outer search.

Answer

Subsearches always run after the outer search completes.