SPLK-5001 Practice Test 9 — 10 Questions

Question 1

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

Accepted Answer

Detailed SPL search queries. Actionable hunts require clear search queries and defined 'next steps' for when a hit is found.

Answer

The budget for the security department

Answer

A copy of the company's network topology map

Answer

A list of all employees in the company

Question 2

Which THREE of the following represent valid ways to use the 'lookup' command?

Accepted Answer

lookup file.csv field1. Standard lookup, lookup with OUTPUT, and lookup with AS aliasing are valid.

Answer

lookup file.csv --all

Answer

lookup file.csv --join

Question 3

What does the 'OR' operator do in a search?

Accepted Answer

Matches either condition.. The 'OR' operator returns results that match either condition.

Answer

Excludes the specified condition.

Answer

Matches both conditions.

Answer

Matches only the first condition.

Question 4

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

Managing notable events. Incident Review is the command center for investigating, assigning, and status-tracking notable events.

Answer

Creating threat intelligence feeds

Answer

Monitoring system performance

Answer

Configuring data ingestion

Question 5

You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?

Accepted Answer

Risk Analysis Adaptive Response Action. The Risk Analysis adaptive response action is the core mechanism in Splunk ES used to generate risk events from notable events or correlation searches.

Answer

Asset and Identity Framework

Answer

Correlation Search Editor

Answer

Notable Event Suppression

Question 6

Which search command is used to join threat intelligence data with your local search results?

Accepted Answer

lookup. The 'lookup' command is the standard way to join event data with external or KV store-based threat intelligence.

Answer

join

Answer

map

Answer

append

Question 7

Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?

Accepted Answer

Threat Intelligence Manager.. The Threat Intelligence Manager is the interface for managing and monitoring external threat feeds.

Answer

Security Posture.

Answer

Asset and Identity.

Answer

Incident Review.

Question 8

Which TWO factors directly impact the urgency of a notable event in Splunk ES?

Accepted Answer

The risk score of the event.. Urgency is calculated by combining the event's inherent risk score and the criticality of the system or user (asset) involved.

Answer

The color scheme of the dashboard.

Answer

The total volume of indexed events.

Answer

The number of active users in the system.

Question 9

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Accepted Answer

Splunk Case Management. In Splunk ES, 'Cases' are the primary mechanism for grouping and managing related notable events during an investigation.

Answer

Notable Event Aggregation

Answer

Notable Event Suppression

Answer

Incident Review Filters

Question 10

Which THREE tasks are performed within the 'CIM Setup' interface?

Accepted Answer

Mapping sourcetypes to data models.. CIM Setup allows administrators to map sourcetypes to data models, enable acceleration, and verify CIM compliance.

Answer

Configuring index retention policies.

Answer

Defining user roles and permissions.